24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RiskWare/Kryptik.a Sample 299c30d7d034… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 299c30d7d034…. Malware family: RiskWare/Kryptik.a. Threat score 80/100. 3/26 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","keywords":["Malicious","RiskWare/Kryptik.a","malware analysis","sandbox report","threat intelligence","299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920"],"about":{"@type":"SoftwareApplication","name":"WhichApp.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"RiskWare/Kryptik.a","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9d7,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "WhichApp.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WhichApp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "WhichApp.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "WhichApp.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "WhichApp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "WhichApp.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "WhichApp.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "WhichApp.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "WhichApp.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WhichApp.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "WhichApp.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "WhichApp.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp")26:T797,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp")27:T457,file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_tkinter.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "WhichApp.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "WhichApp.exe")28:T1b21,"WhichApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006616) "WhichApp.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006616) "WhichApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000e0597f20fa7f0000f0e51c2ca501000050d81d2ca5010000acd59d20fa7f0000f0e51c2ca501000001000000ffffffff9028ba20fa7f000000000000a5010000a9d59d20fa7f000000000000000000002b8f7f20fa7f0000d0501a2ca5010000d0501a2ca50100009028ba20fa7f00006a457a20fa7f0000ffffffffffffffffc0bdde9269000000ffffffffffffffffa0bdde9269000000e842d120fa7f00002e867f20fa7f000008000000000000000800000000000000f87d9d20fa7f00007f7e7f20fa7f0000080000000000000000000000fa7f0000106c152ca5010000106c152ca5010000106c152ca50100006e91aaa321500000e842d120 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000028a9de9269000000db045b4cfa7f0000000000000000000000000000000000000100000000000000292efa47fa7f000000000000000000000000fa47fa7f0000000000000000000080c9604cfa7f0000000000000000000034adde926900000000000000000000000100000000000000010000000000000041bfd648fa7f00000100000000000000ffb62423fa7f000010ae5f2ca5010000a7135a4cfa7f000000000000eb271c0000000000000400bc0100000000000000f1b72423fa7f000007000000000000000003fe7f0000000000000000000000003f27fa47fa7f00000003fe7f00000000c4b12423fa7f00000003fe7f (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac044afa7f0000000000000000000051ed5d4cfa7f000000000000a50100000000000000000000cc1e234cb80f00002a0000000000000000263f2aa50100008fec5d4cfa7f0000e0ac044afa7f0000e0ac044afa7f0000000000000000000000000000fa7f0000ffffff7f140c000000000000000000000000000000000000d8cef849fa7f00002a0000000000000069c3b149fa7f000031000000000000000c0200000000000010020000000000001100011000000000e0a7de926900000003a3384cfa7f0000e0a7de926900000000000000000000002b00000000000000000000000000000020b0b749fa7f0000b43fb649fa7f0000e0cef849 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000006083ae2ca501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bc08234cb80f000000000000000000000000f246fa7f0000090000000000000060037320fa7f0000000000000000000050d4bc2ca5010000000000000000000050d4bc2ca5010000f6075b4cfa7f0000000000000000000030b3de92690000000000000000000000000000000000000068b2de926900000000000000000000000000000000000000f026f246fa7f000009000000 (UID: 00000000-00003760) "WhichApp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000e0597f20fa7f0000c04ac62ca501000040aa9c2da5010000acd59d20fa7f0000c04ac62ca501000001000000ffffffff9028ba20fa7f000000000000fa7f0000a9d59d20fa7f000000000000000000002b8f7f20fa7f00001086192ca50100001086192ca50100009028ba20fa7f00006a457a20fa7f0000ffffffffffffffffb0bcde9269000000ffffffffffffffff90bcde9269000000e842d120fa7f00002e867f20fa7f000008000000000000000800000000000000f87d9d20fa7f00007f7e7f20fa7f0000080000000000000000000000fa7f0000a0aa9c2da5010000a0aa9c2da5010000a0aa9c2da50100005e96aaa321500000e842d120 (UID: 00000000-00003760) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004204)29:T405,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "WhichApp.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "WhichApp.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "WhichApp.exe") Found reference to API "ExpandEnvironmentStrings() - Expand the env strings in a REG_EXPAND_SZ" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003760.00000000.113438.2A3C0000.00000004.mdmp, 00000000-00003760.00000001.115360.2A3C0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2A3C0000.00000004.mdmp") Found reference to API "ExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp")2a:Te8a,"WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\Pythonwin" at 00000000-00006616-00000C17-766807494 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-766992922 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767005290 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767008702 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767009443 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767019638 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767020410 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767028932 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767029670 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767032428 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767033279 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767036448 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767037203 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767040047 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767040771 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767044139 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767045019 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767047810 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767048762 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767051600 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767052456 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767055417 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-767056219 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data" at 00000000-00006616-00000C17-767059139 "WhichApp.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding" at 00000000-00006616-00000C17-7670600132b:Tbdb,"WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162 (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\Pythonwin (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\encoding (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\http1.0 (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\msgs (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\opt0.4 (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Africa (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\America (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\America\Argentina (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\America\Indiana (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\America\Kentucky (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\America\North_Dakota (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Antarctica (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Arctic (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Asia (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Atlantic (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Australia (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Brazil (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Canada (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Chile (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Etc (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Europe (UID: 00000000-00006616) "WhichApp.exe" called "CreateDirectoryW" with parameter %TEMP%\_MEI66162\_tcl_data\tzdata\Indian (UID: 00000000-00006616)2c:Teb3,"WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006616) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006616) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006616) "WhichApp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006616) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006616) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\python311.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\python3 (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\_ctypes.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\_bz2.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\_lzma.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\_tkinter.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\_socket.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\select.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\psutil\_psutil_windows.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\pywin32_system32\pywintypes311.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\pywin32_system32\pythoncom311.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\win32\win32api.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\win32\win32event.pyd (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI66162\tkdnd2.8\tkdnd28.dll (UID: 00000000-00003760) "WhichApp.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00003760) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004204) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004204)2d:T702b,"WhichApp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006616) "WhichApp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_ExitStatusException (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_InitializeFromConfig (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_IsInitialized (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Py_PreInitialize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_Clear (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_InitIsolatedConfig (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_Read (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_SetBytesString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_SetString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyConfig_SetWideStringList (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyPreConfig_InitIsolatedConfig (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyStatus_Exception (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__bz2 (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__lzma (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__tkinter (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CancelSynchronousIo (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__socket (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit_select (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit__psutil_windows (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RtlIpv4AddressToStringA (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetExtendedTcpTable (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetExtendedUdpTable (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosErrorNoTeb (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RtlIpv6AddressToStringA (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetActiveProcessorCount (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessDeniedAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessAllowedAceEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessAllowedObjectAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessDeniedAceEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAccessDeniedObjectAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAuditAccessAceEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter AddAuditAccessObjectAce (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorControl (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit_pywintypes (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit_pythoncom (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoGetCancelObject (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit_win32api (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetComputerObjectNameW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLongPathNameA (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetSystemFileCacheSize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetDllDirectoryW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetSystemPowerState (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter ChangeDisplaySettingsExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegRestoreKeyW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegSaveKeyExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegCreateKeyTransactedW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegOpenKeyTransactedW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegDeleteKeyTransactedW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegCopyTreeW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter RegOverridePredefKey (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter PyInit_win32event (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Tkdnd_Init (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Tkdnd_SafeInit (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Tkdnd_Unload (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter _Tkdnd_Unload (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter Tkdnd_SafeUnload (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter _Tkdnd_SafeUnload (UID: 00000000-00003760) "WhichApp.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00003760) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004204) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004204)2e:Tf1ea,Found reference to API (Indicator: "OpenProcessToken"; File: "WhichApp.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "WhichApp.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteObject"; File: "WhichApp.exe") Found reference to API (Indicator: "SelectObject"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "WhichApp.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "WhichApp.exe") Found reference to API (Indicator: "CloseHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "EncodePointer"; File: "WhichApp.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetLastError"; File: "WhichApp.exe") Found reference to API (Indicator: "GetOEMCP"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetStdHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "WhichApp.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "WhichApp.exe") Found reference to API (Indicator: "TlsAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "RaiseException"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "WhichApp.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "WhichApp.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateProcessW"; File: "WhichApp.exe") Found reference to API (Indicator: "CompareStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "WhichApp.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "FlsAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "WhichApp.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTempPathW"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "WhichApp.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "WhichApp.exe") Found reference to API (Indicator: "FlsFree"; File: "WhichApp.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "WhichApp.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "WhichApp.exe") Found reference to API (Indicator: "FindNextFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "WhichApp.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "WhichApp.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "WhichApp.exe") Found reference to API (Indicator: "K32EnumProcessModules"; File: "WhichApp.exe") Found reference to API (Indicator: "VirtualProtect"; File: "WhichApp.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "ReadFile"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "WhichApp.exe") Found reference to API (Indicator: "FlsGetValue"; File: "WhichApp.exe") Found reference to API (Indicator: "SetStdHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "WhichApp.exe") Found reference to API (Indicator: "TerminateProcess"; File: "WhichApp.exe") Found reference to API (Indicator: "FreeLibrary"; File: "WhichApp.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "WhichApp.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "WhichApp.exe") Found reference to API (Indicator: "GetACP"; File: "WhichApp.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "WhichApp.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "WhichApp.exe") Found reference to API (Indicator: "TlsSetValue"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "HeapAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "WhichApp.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "WhichApp.exe") Found reference to API (Indicator: "TlsFree"; File: "WhichApp.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "WhichApp.exe") Found reference to API (Indicator: "MulDiv"; File: "WhichApp.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "HeapSize"; File: "WhichApp.exe") Found reference to API (Indicator: "FlsSetValue"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "WhichApp.exe") Found reference to API (Indicator: "WriteFile"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLastError"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "WhichApp.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCPInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "WhichApp.exe") Found reference to API (Indicator: "TlsGetValue"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileType"; File: "WhichApp.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "WhichApp.exe") Found reference to API (Indicator: "FormatMessageW"; File: "WhichApp.exe") Found reference to API (Indicator: "LocalFree"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "WhichApp.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "WhichApp.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "WhichApp.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "WhichApp.exe") Found reference to API (Indicator: "ExitProcess"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "Sleep"; File: "WhichApp.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "WhichApp.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "WhichApp.exe") Found reference to API (Indicator: "FindClose"; File: "WhichApp.exe") Found reference to API (Indicator: "LCMapStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "HeapFree"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcAddress"; File: "WhichApp.exe") Found reference to API (Indicator: "MoveWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "ReleaseDC"; File: "WhichApp.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API (Indicator: "InvalidateRect"; File: "WhichApp.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetClientRect"; File: "WhichApp.exe") Found reference to API (Indicator: "TranslateMessage"; File: "WhichApp.exe") Found reference to API (Indicator: "PeekMessageW"; File: "WhichApp.exe") Found reference to API (Indicator: "ShowWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDC"; File: "WhichApp.exe") Found reference to API (Indicator: "MessageBoxA"; File: "WhichApp.exe") Found reference to API (Indicator: "MessageBoxW"; File: "WhichApp.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "DestroyIcon"; File: "WhichApp.exe") Found reference to API (Indicator: "DestroyWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "RegisterClassW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "WhichApp.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "WhichApp.exe") Found reference to API (Indicator: "CompareStringEx"; File: "WhichApp.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "WhichApp.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateDirectory"; File: "WhichApp.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "WhichApp.exe") Found reference to API (Indicator: "ReportEventW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "WhichApp.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "WhichApp.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteFiber"; File: "WhichApp.exe") Found reference to API (Indicator: "ConvertThreadToFiber"; File: "WhichApp.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "WhichApp.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateFiber"; File: "WhichApp.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemTime"; File: "WhichApp.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "WhichApp.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "WhichApp.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "WhichApp.exe") Found reference to API (Indicator: "WSASetLastError"; File: "WhichApp.exe") Found reference to API (Indicator: "getsockname"; File: "WhichApp.exe") Found reference to API (Indicator: "ntohs"; File: "WhichApp.exe") Found reference to API (Indicator: "closesocket"; File: "WhichApp.exe") Found reference to API (Indicator: "WSACleanup"; File: "WhichApp.exe") Found reference to API (Indicator: "ioctlsocket"; File: "WhichApp.exe") Found reference to API (Indicator: "WSAStartup"; File: "WhichApp.exe") Found reference to API (Indicator: "gethostbyname"; File: "WhichApp.exe") Found reference to API (Indicator: "getsockopt"; File: "WhichApp.exe") Found reference to API (Indicator: "recvfrom"; File: "WhichApp.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "WhichApp.exe") Found reference to API (Indicator: "ImpersonateSelf"; File: "WhichApp.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "EqualSid"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileSecurityW"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "WhichApp.exe") Found reference to API (Indicator: "RevertToSelf"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; File: "WhichApp.exe") Found reference to API (Indicator: "GetUserNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "WhichApp.exe") Found reference to API (Indicator: "AccessCheck"; File: "WhichApp.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "WhichApp.exe") Found reference to API (Indicator: "BuildCommDCBW"; File: "WhichApp.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "WhichApp.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "ResetEvent"; File: "WhichApp.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "WhichApp.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateThread"; File: "WhichApp.exe") Found reference to API (Indicator: "lstrlenW"; File: "WhichApp.exe") Found reference to API (Indicator: "MoveFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "PeekConsoleInputW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "WhichApp.exe") Found reference to API (Indicator: "GetVersionExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCommTimeouts"; File: "WhichApp.exe") Found reference to API (Indicator: "CreatePipe"; File: "WhichApp.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "WhichApp.exe") Found reference to API (Indicator: "TerminateThread"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "WhichApp.exe") Found reference to API (Indicator: "ClearCommError"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCommState"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "WhichApp.exe") Found reference to API (Indicator: "EscapeCommFunction"; File: "WhichApp.exe") Found reference to API (Indicator: "SetFilePointer"; File: "WhichApp.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "WhichApp.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCommModemStatus"; File: "WhichApp.exe") Found reference to API (Indicator: "SleepEx"; File: "WhichApp.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetEvent"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCommState"; File: "WhichApp.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "WhichApp.exe") Found reference to API (Indicator: "SetupComm"; File: "WhichApp.exe") Found reference to API (Indicator: "PurgeComm"; File: "WhichApp.exe") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateEventW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "WhichApp.exe") Found reference to API (Indicator: "CopyFileW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetFileTime"; File: "WhichApp.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "WhichApp.exe") Found reference to API (Indicator: "SearchPathW"; File: "WhichApp.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "WhichApp.exe") Found reference to API (Indicator: "NetUserGetInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "NetGetDCName"; File: "WhichApp.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "WhichApp.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "WhichApp.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "WhichApp.exe") Found reference to API (Indicator: "CharLowerW"; File: "WhichApp.exe") Found reference to API (Indicator: "MessageBeep"; File: "WhichApp.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "WhichApp.exe") Found reference to API (Indicator: "wsprintfW"; File: "WhichApp.exe") Found reference to API (Indicator: "wsprintfA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetTimer"; File: "WhichApp.exe") Found reference to API (Indicator: "KillTimer"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProfilesDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "getservbyname"; File: "WhichApp.exe") Found reference to API (Indicator: "inet_ntoa"; File: "WhichApp.exe") Found reference to API (Indicator: "getpeername"; File: "WhichApp.exe") Found reference to API (Indicator: "gethostname"; File: "WhichApp.exe") Found reference to API (Indicator: "htons"; File: "WhichApp.exe") Found reference to API (Indicator: "WSAAsyncSelect"; File: "WhichApp.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegCloseKey"; File: "WhichApp.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDIBits"; File: "WhichApp.exe") Found reference to API (Indicator: "GetObjectA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMapMode"; File: "WhichApp.exe") Found reference to API (Indicator: "DPtoLP"; File: "WhichApp.exe") Found reference to API (Indicator: "GetStockObject"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteDC"; File: "WhichApp.exe") Found reference to API (Indicator: "BitBlt"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "WhichApp.exe") Found reference to API (Indicator: "CreatePatternBrush"; File: "WhichApp.exe") Found reference to API (Indicator: "TextOutA"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "WhichApp.exe") Found reference to API (Indicator: "SetMapMode"; File: "WhichApp.exe") Found reference to API (Indicator: "LockResource"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadResource"; File: "WhichApp.exe") Found reference to API (Indicator: "FindResourceW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalLock"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTickCount"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "WhichApp.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "WhichApp.exe") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "WhichApp.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "WhichApp.exe") Found reference to API (Indicator: "IsZoomed"; File: "WhichApp.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "WhichApp.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "WhichApp.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "WhichApp.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadCursorA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateCaret"; File: "WhichApp.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSysColor"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFocus"; File: "WhichApp.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "GetParent"; File: "WhichApp.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "WhichApp.exe") Found reference to API (Indicator: "FillRect"; File: "WhichApp.exe") Found reference to API (Indicator: "GetClipboardData"; File: "WhichApp.exe") Found reference to API (Indicator: "CloseClipboard"; File: "WhichApp.exe") Found reference to API (Indicator: "IsWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateIconFromResource"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "WhichApp.exe") Found reference to API (Indicator: "PeekMessageA"; File: "WhichApp.exe") Found reference to API (Indicator: "EnableWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "DrawEdge"; File: "WhichApp.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "WhichApp.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadIconW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "SetFocus"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadCursorW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCursorPos"; File: "WhichApp.exe") Found reference to API (Indicator: "DestroyCaret"; File: "WhichApp.exe") Found reference to API (Indicator: "UpdateWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "GetCapture"; File: "WhichApp.exe") Found reference to API (Indicator: "InsertMenuW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "SetWindowPos"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateIconIndirect"; File: "WhichApp.exe") Found reference to API (Indicator: "SetParent"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "WhichApp.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCursor"; File: "WhichApp.exe") Found reference to API (Indicator: "SendInput"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "DestroyMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "ClientToScreen"; File: "WhichApp.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "WhichApp.exe") Found reference to API (Indicator: "SetClipboardData"; File: "WhichApp.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadCursorFromFileA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMessageA"; File: "WhichApp.exe") Found reference to API (Indicator: "BeginPaint"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCaretPos"; File: "WhichApp.exe") Found reference to API (Indicator: "SetMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "ScreenToClient"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowRect"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "RemoveMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenClipboard"; File: "WhichApp.exe") Found reference to API (Indicator: "GetKeyState"; File: "WhichApp.exe") Found reference to API (Indicator: "IsIconic"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumWindows"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCapture"; File: "WhichApp.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "WhichApp.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "WhichApp.exe") Found reference to API (Indicator: "CoInitialize"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalSize"; File: "WhichApp.exe") Found reference to API (Indicator: "VirtualFree"; File: "WhichApp.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "WhichApp.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "WhichApp.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "SysFreeString"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "WhichApp.exe") Found reference to API (Indicator: "VariantChangeType"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "WhichApp.exe") Found reference to API (Indicator: "VariantClear"; File: "WhichApp.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "WhichApp.exe") Found reference to API (Indicator: "SysStringLen"; File: "WhichApp.exe") Found reference to API (Indicator: "VariantInit"; File: "WhichApp.exe") Found reference to API (Indicator: "GetActiveObject"; File: "WhichApp.exe") Found reference to API (Indicator: "SysAllocString"; File: "WhichApp.exe") Found reference to API (Indicator: "OleInitialize"; File: "WhichApp.exe") Found reference to API (Indicator: "CoGetObject"; File: "WhichApp.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "WhichApp.exe") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "WhichApp.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "WhichApp.exe") Found reference to API (Indicator: "CoUninitialize"; File: "WhichApp.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "WhichApp.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "WhichApp.exe") Found reference to API (Indicator: "CoMarshalInterface"; File: "WhichApp.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; File: "WhichApp.exe") Found reference to API (Indicator: "SetSecurityDescriptorSacl"; File: "WhichApp.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorControl"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "WhichApp.exe") Found reference to API (Indicator: "IsValidAcl"; File: "WhichApp.exe") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLengthSid"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "WhichApp.exe") Found reference to API (Indicator: "IsValidSid"; File: "WhichApp.exe") Found reference to API (Indicator: "GetAce"; File: "WhichApp.exe") Found reference to API (Indicator: "AddAce"; File: "WhichApp.exe") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorLength"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeAcl"; File: "WhichApp.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "WhichApp.exe") Found reference to API (Indicator: "AddAuditAccessAce"; File: "WhichApp.exe") Found reference to API (Indicator: "GetAclInformation"; File: "WhichApp.exe") Found reference to API (Indicator: "IsTextUnicode"; File: "WhichApp.exe") Found reference to API (Indicator: "MakeSelfRelativeSD"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; File: "WhichApp.exe") Found reference to API (Indicator: "MakeAbsoluteSD"; File: "WhichApp.exe") Found reference to API (Indicator: "CopySid"; File: "WhichApp.exe") Found reference to API (Indicator: "IsValidSecurityDescriptor"; File: "WhichApp.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "WhichApp.exe") Found reference to API (Indicator: "InitializeSid"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteAce"; File: "WhichApp.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "WhichApp.exe") Found reference to API (Indicator: "LocalAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "WhichApp.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "WhichApp.exe") Found reference to API (Indicator: "DecodePointer"; File: "WhichApp.exe") Found reference to API (Indicator: "lstrcpyW"; File: "WhichApp.exe") Found reference to API (Indicator: "CharNextA"; File: "WhichApp.exe") Found reference to API (Indicator: "RtlUnwind"; File: "WhichApp.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "WhichApp.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "WhichApp.exe") Found reference to API (Indicator: "VirtualQuery"; File: "WhichApp.exe") Found reference to API (Indicator: "StretchBlt"; File: "WhichApp.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "WhichApp.exe") Found reference to API (Indicator: "GetObjectW"; File: "WhichApp.exe") Found reference to API (Indicator: "HeapDestroy"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryActCtxW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetConsoleTitleW"; File: "WhichApp.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "WhichApp.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "WhichApp.exe") Found reference to API (Indicator: "FindActCtxSectionStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateActCtxW"; File: "WhichApp.exe") Found reference to API (Indicator: "DeactivateActCtx"; File: "WhichApp.exe") Found reference to API (Indicator: "GetConsoleTitleW"; File: "WhichApp.exe") Found reference to API (Indicator: "DebugBreak"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalFree"; File: "WhichApp.exe") Found reference to API (Indicator: "FindResourceExW"; File: "WhichApp.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "WhichApp.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "WhichApp.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "WhichApp.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "WhichApp.exe") Found reference to API (Indicator: "ShowCaret"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSubMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "IsChild"; File: "WhichApp.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "WhichApp.exe") Found reference to API (Indicator: "AppendMenuW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowDC"; File: "WhichApp.exe") Found reference to API (Indicator: "HideCaret"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTopWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "EqualRect"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "ModifyMenuW"; File: "WhichApp.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "WhichApp.exe") Found reference to API (Indicator: "RedrawWindow"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadMenuW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "WhichApp.exe") Found reference to API (Indicator: "CopyRect"; File: "WhichApp.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "WhichApp.exe") Found reference to API (Indicator: "MapDialogRect"; File: "WhichApp.exe") Found reference to API (Indicator: "FrameRect"; File: "WhichApp.exe") Found reference to API (Indicator: "DrawIcon"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDCEx"; File: "WhichApp.exe") Found reference to API (Indicator: "GetMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "DeleteMenu"; File: "WhichApp.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "WhichApp.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegSetKeySecurity"; File: "WhichApp.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegFlushKey"; File: "WhichApp.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; File: "WhichApp.exe") Found reference to API (Indicator: "RegLoadKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegConnectRegistryW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegUnLoadKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegGetKeySecurity"; File: "WhichApp.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegCreateKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegSaveKeyW"; File: "WhichApp.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumResourceTypesW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProfileIntW"; File: "WhichApp.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "WhichApp.exe") Found reference to API (Indicator: "MoveFileExW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetVersion"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLocalTime"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemPowerStatus"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProfileSectionW"; File: "WhichApp.exe") Found reference to API (Indicator: "WinExec"; File: "WhichApp.exe") Found reference to API (Indicator: "WriteProfileStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "WhichApp.exe") Found reference to API (Indicator: "SetSystemTime"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "WhichApp.exe") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "WhichApp.exe") Found reference to API (Indicator: "BeginUpdateResourceW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetTimeZoneInformation"; File: "WhichApp.exe") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; File: "WhichApp.exe") Found reference to API (Indicator: "UpdateResourceW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "WhichApp.exe") Found reference to API (Indicator: "WriteProfileSectionW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "WhichApp.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "WhichApp.exe") Found reference to API (Indicator: "WritePrivateProfileSectionW"; File: "WhichApp.exe") Found reference to API (Indicator: "SizeofResource"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenThread"; File: "WhichApp.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "WhichApp.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "FindCloseChangeNotification"; File: "WhichApp.exe") Found reference to API (Indicator: "FindNextChangeNotification"; File: "WhichApp.exe") Found reference to API (Indicator: "SetErrorMode"; File: "WhichApp.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenProcess"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "WhichApp.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "WhichApp.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "WhichApp.exe") Found reference to API (Indicator: "EndUpdateResourceW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetLocalTime"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumResourceLanguagesW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "WhichApp.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "WhichApp.exe") Found reference to API (Indicator: "ShowCursor"; File: "WhichApp.exe") Found reference to API (Indicator: "LoadStringW"; File: "WhichApp.exe") Found reference to API (Indicator: "ClipCursor"; File: "WhichApp.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "WhichApp.exe") Found reference to API (Indicator: "SetCursorPos"; File: "WhichApp.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "WhichApp.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "WhichApp.exe") Found reference to API (Indicator: "VerifyVersionInfoA"; File: "WhichApp.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "WhichApp.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "WhichApp.exe") Found reference to API (Indicator: "getservbyport"; File: "WhichApp.exe") Found reference to API (Indicator: "getprotobyname"; File: "WhichApp.exe") Found reference to API (Indicator: "ntohl"; File: "WhichApp.exe") Found reference to API (Indicator: "WSAIoctl"; File: "WhichApp.exe") Found reference to API (Indicator: "htonl"; File: "WhichApp.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "WhichApp.exe") Found reference to API (Indicator: "inet_addr"; File: "WhichApp.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenSCManagerA"; File: "WhichApp.exe") Found reference to API (Indicator: "ControlService"; File: "WhichApp.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryServiceConfigW"; File: "WhichApp.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenServiceA"; File: "WhichApp.exe") Found reference to API (Indicator: "StartServiceA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "WhichApp.exe") Found reference to API (Indicator: "GetIfTable"; File: "WhichApp.exe") Found reference to API (Indicator: "GetSystemTimes"; File: "WhichApp.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "WhichApp.exe") Found reference to API (Indicator: "lstrcmpA"; File: "WhichApp.exe") Found reference to API (Indicator: "FindFirstVolumeMountPointA"; File: "WhichApp.exe") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "WhichApp.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "WhichApp.exe") Found reference to API (Indicator: "Process32Next"; File: "WhichApp.exe") Found reference to API (Indicator: "Process32First"; File: "WhichApp.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "WhichApp.exe") Found reference to API (Indicator: "Thread32Next"; File: "WhichApp.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "WhichApp.exe") Found reference to API (Indicator: "FindVolumeMountPointClose"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessIoCounters"; File: "WhichApp.exe") Found reference to API (Indicator: "GetThreadTimes"; File: "WhichApp.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "WhichApp.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessHandleCount"; File: "WhichApp.exe") Found reference to API (Indicator: "Thread32First"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "WhichApp.exe") Found reference to API (Indicator: "QueryDosDeviceA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetPriorityClass"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateFileA"; File: "WhichApp.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "WhichApp.exe") Found reference to API (Indicator: "EnumProcesses"; File: "WhichApp.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "WhichApp.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenWaitableTimerW"; File: "WhichApp.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenSemaphoreW"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenMutexW"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "WhichApp.exe") Found reference to API (Indicator: "OpenEventW"; File: "WhichApp.exe") Found reference to API (Indicator: "PulseEvent"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateWaitableTimerW"; File: "WhichApp.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "WhichApp.exe") Found reference to API (Indicator: "SignalObjectAndWait"; File: "WhichApp.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "WhichApp.exe") Found reference to API (Indicator: "CancelWaitableTimer"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateMutexW"; File: "WhichApp.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "WhichApp.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "WhichApp.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "WhichApp.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "WhichApp.exe") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003760.00000000.113438.20B98000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.20B98000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMapping"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412AD000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.359F8000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000001.115360.416F3000.00000002.mdmp, 00000000-00003760.00000001.115360.46D76000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2308C000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412AD000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.359F8000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000001.115360.416F3000.00000002.mdmp, 00000000-00003760.00000001.115360.46D76000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2308C000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp")2f:T51b,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "WhichApp.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "WhichApp.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "WhichApp.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "WhichApp.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp")30:T935,"libcrypto-1_1.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-1_1.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-1_1.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-1_1.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-1_1.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-1_1.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-1_1.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-1_1.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-1_1.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-1_1.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-1_1.dll" contains export function called "AES_decrypt" at ordinal 2531:Tf1e,"WhichApp.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tcl86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tk86t.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pythoncom311.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pywintypes311.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tkdnd28.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "python3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libffi-8.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32ui.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32api.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_psutil_windows.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_tkinter.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "select.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32event.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "win32trace.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT32:Tf65,"WhichApp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa48d00000 "WhichApp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa48d00000 "WhichApp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa48d00000 "WhichApp.exe" loaded module "KERNEL32" at base 7ffa4c400000 "WhichApp.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa20d50000 "WhichApp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffa48d00000 "WhichApp.exe" loaded module "RPCRT4.DLL" at base 7ffa4b810000 "WhichApp.exe" loaded module "NTDLL.DLL" at base 7ffa4c590000 "WhichApp.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa46f20000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\PYTHON311.DLL" at base 7ffa20780000 "WhichApp.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffa491a0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\PYTHON3" at base 1a52a390000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\_CTYPES.PYD" at base 7ffa412c0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\_BZ2.PYD" at base 7ffa412a0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\_LZMA.PYD" at base 7ffa359e0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\_TKINTER.PYD" at base 7ffa41280000 "WhichApp.exe" loaded module "KERNEL32.DLL" at base 7ffa4c400000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\_SOCKET.PYD" at base 7ffa3e790000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\SELECT.PYD" at base 7ffa416f0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\PSUTIL\_PSUTIL_WINDOWS.PYD" at base 7ffa35b50000 "WhichApp.exe" loaded module "IPHLPAPI.DLL" at base 7ffa47ea0000 "WhichApp.exe" loaded module "NTDLL" at base 7ffa4c590000 "WhichApp.exe" loaded module "WTSAPI32.DLL" at base 7ffa44920000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\PYWIN32_SYSTEM32\PYWINTYPES311.DLL" at base 7ffa352f0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\PYWIN32_SYSTEM32\PYTHONCOM311.DLL" at base 7ffa23030000 "WhichApp.exe" loaded module "URLMON.DLL" at base 7ffa3cf50000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\WIN32\WIN32API.PYD" at base 7ffa32d60000 "WhichApp.exe" loaded module "SECUR32.DLL" at base 7ffa3ecf0000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\WIN32\WIN32EVENT.PYD" at base 7ffa360f0000 "WhichApp.exe" loaded module "UXTHEME.DLL" at base 7ffa46f20000 "WhichApp.exe" loaded module "%TEMP%\_MEI66162\TKDND2.8\TKDND28.DLL" at base 7ffa2d7f0000 "WhichApp.exe" loaded module "SHELL32" at base 7ffa49a60000 "WhichApp.exe" loaded module "GDI32.DLL" at base 7ffa4b7e0000 "WhichApp.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffa322c0000 "WhichApp.exe" loaded module "OLEAUT32.DLL" at base 1a52bf80000 "WhichApp.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffa4b2c0000 "WhichApp.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffa4b2c0000 "WhichApp.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffa4b450000 "WhichApp.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffa4aea0000 "WhichApp.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffa4b930000 "WhichApp.exe" loaded module "COMCTL32.DLL" at base 7ffa38520000 "cmd.exe" loaded module "KERNEL32" at base 7ffa4c400000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa48d00000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa48d00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa48d00000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffa4b760000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa48d00000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa48d00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa48d00000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa20d5000033:Teca,"WhichApp.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WhichApp.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Linker" and name: "Linker" "tcl86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tcl86t.dll" was detected as "Microsoft Linker" and name: "Linker" "tk86t.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tk86t.dll" was detected as "Microsoft Linker" and name: "Linker" "pythoncom311.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pythoncom311.dll" was detected as "Microsoft Linker" and name: "Linker" "pywintypes311.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pywintypes311.dll" was detected as "Microsoft Linker" and name: "Linker" "tkdnd28.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tkdnd28.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Linker" and name: "Linker" "python3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python3.dll" was detected as "Microsoft Linker" and name: "Linker" "VCRUNTIME140_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140_1.dll" was detected as "Microsoft Linker" and name: "Linker" "libffi-8.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libffi-8.dll" was detected as "Microsoft Linker" and name: "Linker" "win32ui.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32ui.pyd" was detected as "Microsoft Linker" and name: "Linker" "unicodedata.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Linker" and name: "Linker" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Linker" and name: "Linker" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Linker" and name: "Linker" "win32api.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32api.pyd" was detected as "Microsoft Linker" and name: "Linker" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Linker" and name: "Linker" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Linker" and name: "Linker" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Linker" and name: "Linker" "_psutil_windows.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_psutil_windows.pyd" was detected as "Microsoft Linker" and name: "Linker" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Linker" and name: "Linker" "_tkinter.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_tkinter.pyd" was detected as "Microsoft Linker" and name: "Linker" "select.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "select.pyd" was detected as "Microsoft Linker" and name: "Linker" "win32event.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32event.pyd" was detected as "Microsoft Linker" and name: "Linker" "win32trace.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "win32trace.pyd" was detected as "Microsoft Linker" and name: "Linker"34:T708,"WhichApp.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-1_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "tcl86t.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "tk86t.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pythoncom311.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pywintypes311.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libffi-8.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32ui.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "unicodedata.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32api.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_bz2.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_socket.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_psutil_windows.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_hashlib.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_tkinter.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "select.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32event.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "win32trace.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_win32sysloader.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"35:T591,"WhichApp.exe" has an executable section named ".text" "libcrypto-1_1.dll" has an executable section named ".text" "tcl86t.dll" has an executable section named ".text" "tk86t.dll" has an executable section named ".text" "pythoncom311.dll" has an executable section named ".text" "pywintypes311.dll" has an executable section named ".text" "tkdnd28.dll" has an executable section named ".text" "VCRUNTIME140.dll" has an executable section named ".text" "VCRUNTIME140_1.dll" has an executable section named ".text" "libffi-8.dll" has an executable section named ".text" "win32ui.pyd" has an executable section named ".text" "unicodedata.pyd" has an executable section named ".text" "_decimal.pyd" has an executable section named ".text" "_lzma.pyd" has an executable section named ".text" "win32api.pyd" has an executable section named ".text" "_ctypes.pyd" has an executable section named ".text" "_bz2.pyd" has an executable section named ".text" "_socket.pyd" has an executable section named ".text" "_psutil_windows.pyd" has an executable section named ".text" "_hashlib.pyd" has an executable section named ".text" "_tkinter.pyd" has an executable section named ".text" "select.pyd" has an executable section named ".text" "win32event.pyd" has an executable section named ".text" "win32trace.pyd" has an executable section named ".text" "_win32sysloader.pyd" has an executable section named ".text"36:T55b,"WhichApp.exe" has an writable section named ".data" "WhichApp.exe" has an writable section named ".fptable" "libcrypto-1_1.dll" has an writable section named ".data" "tcl86t.dll" has an writable section named ".data" "tk86t.dll" has an writable section named ".data" "pythoncom311.dll" has an writable section named ".data" "pywintypes311.dll" has an writable section named ".data" "tkdnd28.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "libffi-8.dll" has an writable section named ".data" "win32ui.pyd" has an writable section named ".data" "unicodedata.pyd" has an writable section named ".data" "_decimal.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "win32api.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data" "_bz2.pyd" has an writable section named ".data" "_socket.pyd" has an writable section named ".data" "_psutil_windows.pyd" has an writable section named ".data" "_hashlib.pyd" has an writable section named ".data" "_tkinter.pyd" has an writable section named ".data" "select.pyd" has an writable section named ".data" "win32event.pyd" has an writable section named ".data" "win32trace.pyd" has an writable section named ".data"37:T337a,"WhichApp.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000d080,add rsp, 0x28,jmp 0x14000ccac,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000d46c,test eax, eax,je 0x14000ce6e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000ce61,cmp rcx, rax,je 0x14000ce75,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3670c], rcx,jne 0x14000ce5c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000ce70,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x14000ce8b," "libcrypto-1_1.dll" file has an entrypoint instructions - "jmp 0x180245918,jmp 0x1802222f0,jmp 0x180232dd0,jmp 0x1801fc170,jmp 0x1801e7260,jmp 0x1800a72e0,jmp 0x1801b6e40,jmp 0x18019c970,jmp 0x18015d570,jmp 0x18019de80,jmp 0x1800df9a0,jmp 0x1801f7d00,jmp 0x1801b17a0,jmp 0x18019c8d0,jmp 0x18010b000,jmp 0x18021d020,jmp 0x180212310,jmp 0x1802344f0,jmp 0x1801c0eb0,jmp 0x180245e10," "tcl86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18016b3fd,call 0x18016b41c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18016b2a8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x49bd8],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18016b4b3," "tk86t.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800ffd9d,call 0x1800ffdbc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800ffc48,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x48238],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1800ffe53," "pythoncom311.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180059255,call 0x180059ed0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800590dc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2dcb],mov rcx, rbx,call qword ptr [rip + 0x2dca],call qword ptr [rip + 0x2db4],mov rcx, rax," "pywintypes311.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000ecbd,call 0x18000f184,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000eb44,int3 ,int3 ,int3 ,jmp 0x18000f110,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x29b0],mov qword ptr [rcx], rax,mov rax, rcx,mov qword ptr [rcx + 8], rdx,ret ,int3 ,push rbx," "tkdnd28.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800070f1,call 0x18000ce90,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180007110,int3 ,int3 ,int3 ,mov rax, rsp,mov qword ptr [rax + 0x20], rbx,mov qword ptr [rax + 0x18], r8,mov dword ptr [rax + 0x10], edx,mov qword ptr [rax + 8], rcx,push rsi,push rdi,push r14,sub rsp, 0x50,mov rsi, r8,mov ebx, edx,mov r14, rcx," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000fe81,call 0x18001028c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000fde8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r10d, edx," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800041c1,call 0x1800044fc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004130,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,lea rax, [rip + 0x2053],mov rbx, rcx,mov qword ptr [rcx], rax,test dl, 1,je 0x180004202,mov edx, 0x18,call 0x18000420c," "libffi-8.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180004cf1,call 0x180004e8c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004b9c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1327],mov rcx, rbx,call qword ptr [rip + 0x1316],call qword ptr [rip + 0x1320],mov rcx, rax," "win32ui.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18009b255,call 0x18009b934,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18009b0dc,int3 ,int3 ,int3 ,mov rax, rsp,mov qword ptr [rax + 8], rbx,mov qword ptr [rax + 0x10], rbp,mov qword ptr [rax + 0x18], rsi,mov qword ptr [rax + 0x20], rdi,push r14,sub rsp, 0x20,mov r10, qword ptr [r9 + 0x38],mov rsi, rdx,mov r14, r8," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002a41,call 0x180002bdc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800028ec,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x25df],mov rcx, rbx,call qword ptr [rip + 0x25de],call qword ptr [rip + 0x25c8],mov rcx, rax," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18002069d,call 0x1800206bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180020548,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x16938],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180020753," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013821,call 0x1800139bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800136cc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x480f],mov rcx, rbx,call qword ptr [rip + 0x480e],call qword ptr [rip + 0x47f8],mov rcx, rax," "win32api.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800107d9,call 0x180011044,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180010660,int3 ,int3 ,int3 ,ret 0,int3 ,mov rax, qword ptr [rcx],ret ,mov rax, qword ptr [rcx],ret ,lea rdx, [rip + 0x6f75],lea rax, [rip + 0x6ef6],sub rcx, rdx,sub rax, rdx,cmp rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180005db1,call 0x180005f4c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180005c5c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xa277],mov rcx, rbx,call qword ptr [rip + 0xa266],call qword ptr [rip + 0xa270],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a64d,call 0x18000a66c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a4f8,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x6988],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a703," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800025e1,call 0x18000277c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000248c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x5a3f],mov rcx, rbx,call qword ptr [rip + 0x5a2e],call qword ptr [rip + 0x5a38],mov rcx, rax," "_psutil_windows.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a57d,call 0x18000a59c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a428,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x5a58],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a633," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003f61,call 0x1800040fc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180003e0c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x30a7],mov rcx, rbx,call qword ptr [rip + 0x3096],call qword ptr [rip + 0x30a0],mov rcx, rax," "_tkinter.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001831,call 0x1800019cc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800016dc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x680f],mov rcx, rbx,call qword ptr [rip + 0x680e],call qword ptr [rip + 0x67f8],mov rcx, rax," "select.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001511,call 0x1800016ac,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800013bc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1b1f],mov rcx, rbx,call qword ptr [rip + 0x1b1e],call qword ptr [rip + 0x1b08],mov rcx, rax," "win32event.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003415,call 0x18000384c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000329c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1c3b],mov rcx, rbx,call qword ptr [rip + 0x1c3a],call qword ptr [rip + 0x1c24],mov rcx, rax," "win32trace.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002825,call 0x180002c5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800026ac,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1823],mov rcx, rbx,call qword ptr [rip + 0x1822],call qword ptr [rip + 0x180c],mov rcx, rax,"38:T4f3,"WhichApp.exe" has high imagebase "0x140000000" "libcrypto-1_1.dll" has high imagebase "0x180000000" "tcl86t.dll" has high imagebase "0x180000000" "tk86t.dll" has high imagebase "0x180000000" "pythoncom311.dll" has high imagebase "0x180000000" "pywintypes311.dll" has high imagebase "0x180000000" "tkdnd28.dll" has high imagebase "0x180000000" "VCRUNTIME140.dll" has high imagebase "0x180000000" "python3.dll" has high imagebase "0x180000000" "VCRUNTIME140_1.dll" has high imagebase "0x180000000" "libffi-8.dll" has high imagebase "0x180000000" "win32ui.pyd" has high imagebase "0x180000000" "unicodedata.pyd" has high imagebase "0x180000000" "_decimal.pyd" has high imagebase "0x180000000" "_lzma.pyd" has high imagebase "0x180000000" "win32api.pyd" has high imagebase "0x180000000" "_ctypes.pyd" has high imagebase "0x180000000" "_bz2.pyd" has high imagebase "0x180000000" "_socket.pyd" has high imagebase "0x180000000" "_psutil_windows.pyd" has high imagebase "0x180000000" "_hashlib.pyd" has high imagebase "0x180000000" "_tkinter.pyd" has high imagebase "0x180000000" "select.pyd" has high imagebase "0x180000000" "win32event.pyd" has high imagebase "0x180000000" "win32trace.pyd" has high imagebase "0x180000000"39:T477,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "?PyWin_GetOrLoadLibraryHandle@@YAPEAUHINSTANCE__@@PEBD@Z" (Indicator: "LoadLibrary"; File: "WhichApp.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp") Found reference to API "LibraryLoader.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp")3a:T672,"WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WhichApp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")3b:Ta80,"WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WHICHAPP"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")3c:T6eb,"WhichApp.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WhichApp.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\VCRUNTIME140.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\VCRUNTIME140_1.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\FLTLIB.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\CRYPTSP.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\UCRTBASE.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\VERSION.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\VERSION.dll" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\BCRYPT.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\bcrypt.dll" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\NETAPI32.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\NETAPI32.dll" "WhichApp.exe" trying to access non-existent file "C:\NETAPI32.DLL" "WhichApp.exe" trying to access non-existent file "C:\NETAPI32.dll" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\pywin32_system32\NETAPI32.DLL" "WhichApp.exe" trying to access non-existent file "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\pywin32_system32\NETAPI32.dll"3d:Tba6,"WhichApp.exe" trying to access non-existent file "C:\WHICHAPP.EXE.LOCAL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\PYTHONWIN" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\Pythonwin\WIN32UI.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_BZ2.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_CTYPES.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_DECIMAL.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_HASHLIB.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_LZMA.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_SOCKET.PYD" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_TCL_DATA" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\CLOCK.TCL" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\ENCODING" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\BIG5.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CNS11643.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1250.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1251.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1252.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1253.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1254.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1255.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1256.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1257.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP1258.ENC" "WhichApp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI66162\_tcl_data\encoding\CP437.ENC"3e:T554,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "WhichApp.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "WhichApp.exe") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp")3f:T1f02,Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "jh.zm" Heuristic match: "9v.fi" Heuristic match: "hz.sr" Heuristic match: "flh.bg" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0m" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0@i" Pattern match: "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0,|%)vhld2digicert" Pattern match: "www.memtest86.com" Pattern match: "https://support.apple.com/en-us/ht201236event" Pattern match: "https://linuxreviews.org/howto_change_the_mouse_speed_in_x" Pattern match: "https://creativecommons.org/licenses/by-sa/3.0/" Pattern match: "http://$url" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei66162/tcl8/8.4/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei66162/tcl8/8.5/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei66162/tcl8/8.6/*.tm" Heuristic match: "c:/users/%osuser%/appdata/local/temp/_mei66162/tcl8/8.5/msgcat-1.6.1.tm" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.python.org" Pattern match: "https://www.python.org/psf/license/" Heuristic match: "``_concatenategenericalias`` from typing.py" Pattern match: "myimport.zip/mydirectory" Heuristic match: "__init__.py" Pattern match: "www.jython.org" Heuristic match: "btcl8\8.4\platform-1.0.18.tm" Heuristic match: "btcl8\8.4\platform\shell-1.1.4.tm" Heuristic match: "btcl8\8.5\msgcat-1.6.1.tm" Heuristic match: "btcl8\8.5\tcltest-2.5.3.tm" Heuristic match: "btcl8\8.6\http-2.9.5.tm" Heuristic match: "struct.py" Heuristic match: "pyinstaller\loader\pyimod02_importers.py" Heuristic match: "pyinstaller\loader\pyimod01_archive.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.executionloader.get_filename" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_source" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\zipimport.py" Pattern match: "https://www.python.org/download/releases/2.3/mro/" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.metapathfinder.invalidate_caches" Heuristic match: "c:\pyinstaller\loader\pyimod01_archive.py" Heuristic match: "c:\pyinstaller\loader\pyimod02_importers.py" Heuristic match: "pyinstaller\loader\pyimod03_ctypes.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\importlib\_bootstrap_external.py" Heuristic match: "pythonpath=tools/peg_generator python3 -m pegen.keywordgen grammar/python.gram grammar/tokens lib/keyword.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\_collections_abc.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.is_package" Pattern match: "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py#l679-l688" Heuristic match: "\__init__.py" Heuristic match: "encodings\__init__.py" Heuristic match: "__.py" Heuristic match: "encodings\utf_8.py" Heuristic match: "encodings\cp1252.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\codecs.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\io.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\abc.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\os.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\stat.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\ntpath.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.create_module" Heuristic match: "c:\struct.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.resourceloader.get_data" Pattern match: "https://en.wikipedia.org/wiki/cache_replacement_policies#least_recently_used_(lru)" Pattern match: "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#l24-l25" Pattern match: "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#l81-l97" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py#l11" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l422" Pattern match: "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py#l312" Heuristic match: "types.py" Heuristic match: "pyinstaller\loader\pyimod04_pywin32.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\genericpath.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.loader.exec_module" Heuristic match: "ctypes\__init__.py" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.pathentryfinder.find_spec" Pattern match: "https://docs.python.org/3/library/importlib.html#importlib.abc.inspectloader.get_code" Heuristic match: "c:\pyinstaller\loader\pyimod03_ctypes.py" Heuristic match: "c:\pyinstaller\loader\pyimod04_pywin32.py" Heuristic match: "pyinstaller\loader\pyiboot01_bootstrap.py" Heuristic match: "pyinstaller\hooks\rthooks\pyi_rth_inspect.py" Heuristic match: "ctypes\_endian.py" Heuristic match: "inspect.py" Heuristic match: "parameter.name" Heuristic match: "ast.py" Heuristic match: "contextlib.py" Heuristic match: "collections\__init__.py" Heuristic match: "reprlib.py" Heuristic match: "functools.py" Heuristic match: "enum.py" Heuristic match: "enum.name" Heuristic match: "dis.py" Heuristic match: "bytecode.info" Heuristic match: "importlib\__init__.py" Heuristic match: "linecache.py" Heuristic match: "warnings.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\importlib\machinery.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\posixpath.py" Heuristic match: "tokenize.py" Heuristic match: "filename.py" Heuristic match: "re\__init__.py" Heuristic match: "token.py" Heuristic match: "t__.py" Heuristic match: "re\_compiler.py" Heuristic match: "re\_constants.py" Heuristic match: "_parser.py" Heuristic match: "re\_parser.py" Heuristic match: "fix.py" Heuristic match: "copyreg.py" Heuristic match: "zipfile.py" Heuristic match: "c:\users\bauw3uc\appdata\local\temp\_mei66162\lib\importlib\util.py" Pattern match: "tar.gz/tar.bz2/tar.xz" Heuristic match: "path.name" Heuristic match: "importlib\_abc.py" Heuristic match: "shutil.py" Heuristic match: ">>> b.name" Heuristic match: ">>> c.name" Pattern match: "abcde.zip/b/c.txt" Heuristic match: ">>> root.name" Heuristic match: "tkinterdnd2\tkinterdnd.py" Pattern match: "http://tip.tcl.tk/48" Heuristic match: "tkinterdnd2\__init__.py" Heuristic match: "copyright (c) 1999-2000, marc-andre lemburg; mailto:mal@lemburg.com" Heuristic match: "copyright (c) 2000-2010, egenix.com software gmbh; mailto:info@egenix.com" Heuristic match: "command when pressed.nc" Heuristic match: "7ttk label widget displays a textual label and/or image.nc" Heuristic match: "or another widget.nc" Heuristic match: "which the user may select to change the currently-displayed window.nc" Heuristic match: "_compat_pickle.py" Pattern match: "https://bugs.python.org/issue42195" Heuristic match: "fnmatch.py" Heuristic match: "bz2.py" Heuristic match: "_compression.py" Heuristic match: "lzma.py"40:T2336,Found URL "https://www.python.org/psf/license/_path_isfilestringio_exitdjagonamesspawnls_isblkraise" - Source: "00000000-00003760.00000000.113438.20B98000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp") Found URL "https://bugs.python.org/issue42195." - Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/ode=0" - Source: "00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875." - Source: "00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764." - Source: "00000000-00003760.00000000.113438.2CCD0000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html." - Source: "00000000-00003760.00000000.113438.2CCD0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issueserror_cluster_resource_vetoed_move_not_enough_resources_on_destinationerror_cluster_resource_vetoed_move_not_enough_resources_on_sourceerror_cluster_resource_contains_unsupported_diff_area_for_shared_volumeserror_install_optional_package_requires_main_package_fulltrust_capability0" - Source: "00000000-00003760.00000000.113438.2D820000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp") Found URL "https://bugs.python.org/issue42195." - Source: "00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp") Found URL "https://code.activestate.com/recipes/578019-bytes-to-human-human-to-bytes-converter/?in=user-4178764." - Source: "00000000-00003760.00000001.115360.2CCD0000.00000004.mdmp") Found URL "http://mail.python.org/pipermail/python-dev/2012-june/120787.html." - Source: "00000000-00003760.00000001.115360.2CCD0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issueserror_cluster_resource_vetoed_move_not_enough_resources_on_destinationerror_cluster_resource_vetoed_move_not_enough_resources_on_sourceerror_cluster_resource_contains_unsupported_diff_area_for_shared_volumeserror_install_optional_package_requires_main_package_fulltrust_capability0" - Source: "00000000-00003760.00000001.115360.2D820000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found URL "https://www.python.org/psf/license/_path_isfilestringio_exitdjagonamesspawnls_isblkraise" - Source: "00000000-00003760.00000002.117279.20B98000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found URL "http://tip.tcl.tk/48)" - Source: "00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found URL "https://bugs.python.org/issue42195." - Source: "00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/ode=0" - Source: "00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp") Found URL "https://github.com/giampaolo/psutil/issues/875." - Source: "00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp") Found URL "https://stackoverflow.com/questions/4457745" - Source: "00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32companynamefiledescriptionfileversion3.11.310.0internalnamewin32trace.pydlegalcopyrightlegaltrademarksoriginalfilenamewin32trace.pydproductnamepywin32productversion3.11.310.0varfileinfotranslationlobal\pythontraceoutputmappingglobal\pythontraceoutputmutexglobal\pythontraceoutputeventglobal\pythontraceoutputemptyeventvs_version_infovs_version_infostringfileinfo040904e4commentshttps://github.com/mhammond/pywin32companynamefiledescriptionfileversion3.11.310.0internalnamewin32trace.pydlegalcopyrightlegaltrademarksoriginalfilenamewin32trace.pydproductnamepywin32productversion3.11.310.0varfileinfotranslation@+" - Source: "00000000-00006616.00000001.114738.4A1F0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32companynamefiledescriptionfileversion3.11.310.0internalnamewin32trace.pydlegalcopyrightlegaltrademarksoriginalfilenamewin32trace.pydproductnamepywin32productversion3.11.310.0varfileinfotranslationlobal\pythontraceoutputmappingglobal\pythontraceoutputmutexglobal\pythontraceoutputeventglobal\pythontraceoutputemptyeventvs_version_infovs_version_infostringfileinfo040904e4commentshttps://github.com/mhammond/pywin32companynamefiledescriptionfileversion3.11.310.0internalnamewin32trace.pydlegalcopyrightlegaltrademarksoriginalfilenamewin32trace.pydproductnamepywin32productversion3.11.310.0varfileinfotranslation@+" - Source: "00000000-00006616.00000002.116659.4A1F0000.00000004.mdmp")41:T8e7,"WhichApp.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI66162\*.* (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter libcrypto-1_1.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter libffi-8.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter psutil (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter python3.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter python311.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter Pythonwin (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter pywin32_system32 (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter tcl8 (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter tcl86t.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter tk86t.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter tkdnd2.8 (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter VCRUNTIME140_1.dll (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter win32 (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _bz2.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _ctypes.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _decimal.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _hashlib.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _lzma.pyd (UID: 00000000-00003760) "WhichApp.exe" called "FindNextFileW" with parameter _socket.pyd (UID: 00000000-00003760)42:T17b1,file/memory contains long string with (Indicator: "aes"; File: "mkpsenc.tcl") file/memory contains long string with (Indicator: "aes"; File: "bgerror.tcl") file/memory contains long string with (Indicator: "aes"; File: "Hobart") file/memory contains long string with (Indicator: "aes"; File: "Macquarie") file/memory contains long string with (Indicator: "aes"; File: "Broken_Hill") file/memory contains long string with (Indicator: "aes"; File: "Melbourne") file/memory contains long string with (Indicator: "aes"; File: "Sydney") file/memory contains long string with (Indicator: "aes"; File: "Lord_Howe") file/memory contains long string with (Indicator: "aes"; File: "Lindeman") file/memory contains long string with (Indicator: "aes"; File: "Brisbane") Found string "path_name -- filesystem location of a Python script, zipfile," (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.20B98000.00000004.mdmp, 00000000-00003760.00000002.117279.20B98000.00000004.mdmp") Found string "a zipfile, or to a specific path inside a zipfile. For example, it can be" (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.20B98000.00000004.mdmp, 00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.20B98000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "zipfile targeted." (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.20B98000.00000004.mdmp, 00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.20B98000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000000.113438.2D419000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D419000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2D419000.00000004.mdmp") Found string "tarfile" (Indicator: "tarfile"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "zipfile" (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\base_library.zip\encodings\base64_codec.pyc" (Indicator: "base64"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "C:\Users\bAuw3UC\AppData\Local\Temp\_MEI66162\zipfile.pyc" (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "base64_codec" (Indicator: "base64"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "Furthermore, some packages expect files() to return either pathlib.Path or zipfile.Path, e.g.," (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found string "z = ZipFile(file, mode="r", compression=ZIP_STORED, allowZip64=True," (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "If it is a path, the file will be opened and closed by ZipFile." (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "allowZip64: if True ZipFile will create files with ZIP64 extensions when" (Indicator: "zipfile"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "email.base64mime" (Indicator: "base64"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp")43:Ta0d,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "WhichApp.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "WhichApp.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "WhichApp.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WhichApp.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "WhichApp.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "WhichApp.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "WhichApp.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "WhichApp.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "WhichApp.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "WhichApp.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "WhichApp.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "WhichApp.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "WhichApp.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412AD000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.359F8000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000001.115360.416F3000.00000002.mdmp, 00000000-00003760.00000001.115360.46D76000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2308C000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp")44:T45a,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "WhichApp.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "WhichApp.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "WhichApp.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "WhichApp.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "WhichApp.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "WhichApp.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "WhichApp.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "WhichApp.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "WhichApp.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "WhichApp.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "WhichApp.exe")45:T7b2,Found string "secrets" (Indicator: "secret"; Source: "00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp") Found string "have_password" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "File %r is encrypted, password required for extraction" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "Set default password for encrypted files." (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "Bad password for file %r" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "ZipFile.setpassword" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "setpassword" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C8D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C8D0000.00000004.mdmp") Found string "The username, password, hostname, and port sub-components of netloc" (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "pwd is the password to decrypt files (only used for reading)." (Indicator: "password"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp")46:Tad5,file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "clrpick.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "scrlbar.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "scale.tcl") file/memory contains long string with (Indicator: ""; File: "menubutton.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "tearoff.tcl") file/memory contains long string with (Indicator: ""; File: "focus.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "panedwindow.tcl")47:Tad3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "WhichApp.exe") Found reference to API "ImpersonateSelf" (Indicator: "ImpersonateSelf"; File: "WhichApp.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "WhichApp.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "WhichApp.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "WhichApp.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "WhichApp.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "WhichApp.exe") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; File: "WhichApp.exe") Found reference to API "?_MakeAbsoluteSD@@YAHPEAXPEAPEAX@Z" (Indicator: "MakeAbsoluteSD"; File: "WhichApp.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "WhichApp.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "WhichApp.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "WhichApp.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "WhichApp.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "WhichApp.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "WhichApp.exe") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; File: "WhichApp.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "WhichApp.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "WhichApp.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "WhichApp.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "WhichApp.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "WhichApp.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "WhichApp.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "WhichApp.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "WhichApp.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "WhichApp.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "WhichApp.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "WhichApp.exe")48:T7ce,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "WhichApp.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "WhichApp.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "WhichApp.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000000.113438.35300000.00000002.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000000.113438.41288000.00000002.mdmp, 00000000-00003760.00000000.113438.412AD000.00000002.mdmp, 00000000-00003760.00000000.113438.412F1000.00000002.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000001.115360.359F8000.00000002.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000001.115360.360F5000.00000002.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000001.115360.416F3000.00000002.mdmp, 00000000-00003760.00000001.115360.46D76000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.20701000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp, 00000000-00003760.00000002.117279.2308C000.00000002.mdmp, 00000000-00003760.00000002.117279.3BF85000.00000002.mdmp")49:T1c18,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: WhichApp.exe] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: tcl86t.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: tcl86t.dll] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: tcl86t.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: tcl86t.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: tcl86t.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: tcl86t.dll] Observed import api "ImpersonateSelf" which can "obtain an access token that impersonates the security context of the calling process" [Source: tcl86t.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: tcl86t.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pythoncom311.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: pywintypes311.dll] Observed import api "AddAuditAccessAce" which can "add a system-audit access control entry (ACE) to a system access control list (ACL)" [Source: pywintypes311.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: pywintypes311.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: pywintypes311.dll] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: pywintypes311.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: pywintypes311.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: pywintypes311.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: pywintypes311.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: pywintypes311.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: pywintypes311.dll] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: pywintypes311.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: pywintypes311.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: pywintypes311.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: pywintypes311.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: pywintypes311.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: pywintypes311.dll] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: pywintypes311.dll] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: pywintypes311.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: pywintypes311.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: pywintypes311.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: pywintypes311.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: pywintypes311.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: pywintypes311.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: pywintypes311.dll] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: pywintypes311.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: win32api.pyd] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: _psutil_windows.pyd] Observed import api "ImpersonateSelf" which can "obtain an access token that impersonates the security context of the calling process" [Source: _psutil_windows.pyd] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: _psutil_windows.pyd] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: win32trace.pyd] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: win32trace.pyd]4a:T9db,"WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WHICHAPP.EXE"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "WhichApp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4b:T1082,"mfc140u.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00006616] "python311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\python311.dll]- [targetUID: 00000000-00006616] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI66162\libcrypto-1_1.dll]- [targetUID: 00000000-00006616] "tcl86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tcl86t.dll]- [targetUID: 00000000-00006616] "tk86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tk86t.dll]- [targetUID: 00000000-00006616] "pythoncom311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\pywin32_system32\pythoncom311.dll]- [targetUID: 00000000-00006616] "pywintypes311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\pywin32_system32\pywintypes311.dll]- [targetUID: 00000000-00006616] "tkdnd28.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tkdnd2.8\tkdnd28.dll]- [targetUID: 00000000-00006616] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\VCRUNTIME140.dll]- [targetUID: 00000000-00006616] "python3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 2 sections"- Location: [%TEMP%\_MEI66162\python3.dll]- [targetUID: 00000000-00006616] "VCRUNTIME140_1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006616] "libffi-8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\_MEI66162\libffi-8.dll]- [targetUID: 00000000-00006616] "win32ui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00006616] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\unicodedata.pyd]- [targetUID: 00000000-00006616] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_decimal.pyd]- [targetUID: 00000000-00006616] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_lzma.pyd]- [targetUID: 00000000-00006616] "win32api.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\win32api.pyd]- [targetUID: 00000000-00006616] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_ctypes.pyd]- [targetUID: 00000000-00006616] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_bz2.pyd]- [targetUID: 00000000-00006616] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_socket.pyd]- [targetUID: 00000000-00006616] "_psutil_windows.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00006616] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_hashlib.pyd]- [targetUID: 00000000-00006616] "_tkinter.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_tkinter.pyd]- [targetUID: 00000000-00006616] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\select.pyd]- [targetUID: 00000000-00006616] "win32event.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\win32event.pyd]- [targetUID: 00000000-00006616]4c:T5f0,"WhichApp.exe" has section name .text with entropy "6.485717289150923" "tcl86t.dll" has section name .text with entropy "6.403797675765089" "tcl86t.dll" has section name .pdata with entropy "6.20569966758464" "tk86t.dll" has section name .text with entropy "6.331481400556607" "tk86t.dll" has section name .pdata with entropy "6.1021633527833" "pythoncom311.dll" has section name .text with entropy "6.16021101883087" "pywintypes311.dll" has section name .text with entropy "6.01853328254181" "tkdnd28.dll" has section name .text with entropy "6.292587875501456" "VCRUNTIME140.dll" has section name .text with entropy "6.444321848356276" "VCRUNTIME140_1.dll" has section name .text with entropy "6.3430339608186" "libffi-8.dll" has section name .text with entropy "6.2584052275210835" "win32ui.pyd" has section name .text with entropy "6.110503352963726" "unicodedata.pyd" has section name .text with entropy "6.350810432454613" "_decimal.pyd" has section name .text with entropy "6.393639505076598" "_lzma.pyd" has section name .text with entropy "6.391669112203809" "_lzma.pyd" has section name .rdata with entropy "6.8046304226079375" "_ctypes.pyd" has section name .text with entropy "6.0877617450662305" "_bz2.pyd" has section name .text with entropy "6.316787828524744" "_psutil_windows.pyd" has section name .text with entropy "6.0419463578254815" "select.pyd" has section name .text with entropy "6.137126015197584" "_win32sysloader.pyd" has section name .text with entropy "6.06370504652121"4d:T11e8,"mfc140u.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\Pythonwin\mfc140u.dll]- [targetUID: 00000000-00006616] "python311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\python311.dll]- [targetUID: 00000000-00006616] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI66162\libcrypto-1_1.dll]- [targetUID: 00000000-00006616] "tcl86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tcl86t.dll]- [targetUID: 00000000-00006616] "tk86t.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tk86t.dll]- [targetUID: 00000000-00006616] "pythoncom311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\pywin32_system32\pythoncom311.dll]- [targetUID: 00000000-00006616] "pywintypes311.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\pywin32_system32\pywintypes311.dll]- [targetUID: 00000000-00006616] "tkdnd28.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\tkdnd2.8\tkdnd28.dll]- [targetUID: 00000000-00006616] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI66162\VCRUNTIME140.dll]- [targetUID: 00000000-00006616] "python3.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 2 sections"- Location: [%TEMP%\_MEI66162\python3.dll]- [targetUID: 00000000-00006616] "VCRUNTIME140_1.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\VCRUNTIME140_1.dll]- [targetUID: 00000000-00006616] "libffi-8.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\_MEI66162\libffi-8.dll]- [targetUID: 00000000-00006616] "win32ui.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\Pythonwin\win32ui.pyd]- [targetUID: 00000000-00006616] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\unicodedata.pyd]- [targetUID: 00000000-00006616] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_decimal.pyd]- [targetUID: 00000000-00006616] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_lzma.pyd]- [targetUID: 00000000-00006616] "win32api.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\win32api.pyd]- [targetUID: 00000000-00006616] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_ctypes.pyd]- [targetUID: 00000000-00006616] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_bz2.pyd]- [targetUID: 00000000-00006616] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_socket.pyd]- [targetUID: 00000000-00006616] "_psutil_windows.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\psutil\_psutil_windows.pyd]- [targetUID: 00000000-00006616] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_hashlib.pyd]- [targetUID: 00000000-00006616] "_tkinter.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\_tkinter.pyd]- [targetUID: 00000000-00006616] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\select.pyd]- [targetUID: 00000000-00006616] "win32event.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\win32event.pyd]- [targetUID: 00000000-00006616] "win32trace.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\win32trace.pyd]- [targetUID: 00000000-00006616] "_win32sysloader.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI66162\win32\_win32sysloader.pyd]- [targetUID: 00000000-00006616]4e:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-cn.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macRomania.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-14.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-15.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macIceland.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC)4f:Taf4,Found string "Route attribute access on a class to __getattr__." (Indicator: "route"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found string "Route" (Indicator: "route"; Source: "00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp, 00000000-00003760.00000000.113438.2D419000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D419000.00000004.mdmp, 00000000-00003760.00000001.115360.2D4DF000.00000004.mdmp, 00000000-00003760.00000001.115360.2DFA2000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp, 00000000-00003760.00000002.117279.2D419000.00000004.mdmp, 00000000-00003760.00000002.117279.2D4DF000.00000004.mdmp, 00000000-00003760.00000002.117279.2DFA2000.00000004.mdmp") Found string "gethostname() -- return the current hostname" (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "gethostbyname() -- map a hostname to its IP number" (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "gethostbyaddr() -- map an IP number or hostname to DNS info" (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "route is" (Indicator: "route"; Source: "00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp") Found string "First the hostname returned by gethostbyaddr() is checked, then" (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp, 00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp") Found string "hostname from gethostname() is returned." (Indicator: "hostname"; Source: "00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp, 00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp")50:T463,"libcrypto-1_1.dll" claimed CRC 3485570 while the actual is CRC 13663126 "tcl86t.dll" claimed CRC 1893568 while the actual is CRC 3485570 "tk86t.dll" claimed CRC 1578097 while the actual is CRC 1893568 "tkdnd28.dll" claimed CRC 142645 while the actual is CRC 171779 "VCRUNTIME140.dll" claimed CRC 119732 while the actual is CRC 142645 "python3.dll" claimed CRC 128478 while the actual is CRC 119732 "VCRUNTIME140_1.dll" claimed CRC 44610 while the actual is CRC 128478 "libffi-8.dll" claimed CRC 72244 while the actual is CRC 44610 "unicodedata.pyd" claimed CRC 1159659 while the actual is CRC 1153174 "_decimal.pyd" claimed CRC 257391 while the actual is CRC 1159659 "_lzma.pyd" claimed CRC 178767 while the actual is CRC 257391 "_ctypes.pyd" claimed CRC 154570 while the actual is CRC 190802 "_bz2.pyd" claimed CRC 86126 while the actual is CRC 154570 "_socket.pyd" claimed CRC 142952 while the actual is CRC 86126 "_hashlib.pyd" claimed CRC 128437 while the actual is CRC 73904 "_tkinter.pyd" claimed CRC 117445 while the actual is CRC 128437 "select.pyd" claimed CRC 62186 while the actual is CRC 11744551:T594,OpenProcessToken GetCommandLineW CreateDirectoryW FindFirstFileExW GetModuleHandleW CreateProcessW FindFirstFileW GetTempPathW LoadLibraryExW GetModuleHandleExW GetFileSizeEx FindNextFileW GetFileAttributesExW VirtualProtect GetDriveTypeW TerminateProcess GetStartupInfoW WriteFile CreateFileW GetCommandLineA GetModuleFileNameW IsDebuggerPresent DeleteFileW Sleep UnhandledExceptionFilter GetProcAddress LoadLibraryW LoadLibraryA GetModuleHandleA sendto socket connect closesocket recv accept WSAStartup listen send recvfrom bind GetUserNameW GetSystemInfo DeviceIoControl CreateThread OutputDebugStringW GetVersionExW GetModuleFileNameA GetFileAttributesW SleepEx GetTempFileNameW CopyFileW GetComputerNameExW RegOpenKeyExW RegCloseKey LockResource FindResourceW GetTickCount GetClipboardData GetCursorPos SetWindowsHookExW VirtualAlloc CreateFileMoniker SetSecurityDescriptorDacl OutputDebugStringA FindResourceExW FindWindowExW GetLastActivePopup FindWindowW RegEnumKeyW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW RegCreateKeyW RegEnumKeyExW GetSystemDirectoryW WinExec GetTickCount64 GetComputerNameW LoadLibraryExA GetLogicalDrives OpenProcess ShellExecuteW WSASocketW StartServiceA Process32Next Process32First ReadProcessMemory GetDriveTypeA CreateToolhelp32Snapshot CreateFileA EnumProcesses MapViewOfFile CreateFileMappingW52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAP/////wAAAAAAAAAAAP//AAAAAAAAAAAAAAD/8AAAAAAAAAAAAAAAAA////ZmZmZmZmZmZmZmZmZv//9mZmZmZmZmZmZmZmZmZv/2ZmZmZmZmZmZmZmZmZmZPBmZmZmZmZmZmZmZmZmZmYAZmZmZmZmZmZmZmZmZmZmD2ZmZmZmZmZmZmZmZmZmZv9mZmZmZmZmZmZmZmZmZmb/ZmZmZmZmZmZmZmZmZmZm/2ZmZmZmZmZmZmZmZmZmZgBmZmZmZmZmZmZmZmZmZmYAZmZmZmZmZmZmZmZmZmZmAGZmZmZmZmZmZmZmZmZmZgBmZmZmZmZmZmZmZmZmZmYAZmZmb2ZmZgZmZmZmZmZmAGZmZm9mZmf2ZmZmZmZmZg9mZmZgZmZv9mZmZmZmZmYPZmZmYGZmZgZmZmZmZmZmD2ZmZmBmZmZmZmZmZmZmZg9mZmZgZmZmZmZmZmZmZmYAZmZmZmZmZmZmZmZmZmZmAGZmZmZmZmZmZmZmZmZmZgBmZmZgBGYAAGZmZmZmZmbwZmZmZmZmZmZmZmZmZmZm8GZmZmZmZmZmZmZmZmZmZvAGZmZmZmZmZmZmZmZmZmAP/2ZmZmZmZmZmZmZmZmb///8AAAAAAAAAAAAAAA//////AAD//////wAP//D//wAP/wAA//////8AAAAAAAAAD////////////////wAAAP4AAAB+AAAAfAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAQAADwceAA8HHgAPBx4ADwcOAA8HhgAPBAYADwYGAA8GBgAPBxwADwAAAA+AAAAfgAAAH8AAAD////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1790802469709,"unified_at":"2026-09-30T21:07:49.709Z","metadata":{"hashes":{"sha256":"299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","sha1":"7af1f06a2ba17e3668da90d1f23fbf30dd51e677","md5":"cb181cef92c84a4667b998961377b024","sha512":"ce7686162d06b258d8357633dcfdc7b4539b2efe0788d0e3abe0518319958a8d1073e58bf816eac88fdae60ecbce2f9eeebe083ac4d48a7f28cdf4d15b64ae2a","ssdeep":"393216:cfZaKBsRvK3qkAW8w9dQfF3MnG3wFaC24cVba4:EaK3DAW8w9dQd3MGg724Ya","ssdeep_chunks":["393216:cfZaKBs","393216:fZaKBsR","393216:ZaKBsRv","393216:aKBsRvK","393216:KBsRvK3","393216:BsRvK3q","393216:sRvK3qk","393216:RvK3qkA","393216:vK3qkAW","393216:K3qkAW8","393216:3qkAW8w","393216:qkAW8w9","393216:kAW8w9d","393216:AW8w9dQ","393216:W8w9dQf","393216:8w9dQfF","393216:w9dQfF3","393216:9dQfF3M","393216:dQfF3Mn","393216:QfF3MnG","393216:fF3MnG3","393216:F3MnG3w","393216:3MnG3wF","393216:MnG3wFa","393216:nG3wFaC","393216:G3wFaC2","393216:3wFaC24","393216:wFaC24c","393216:FaC24cV","393216:aC24cVb","393216:C24cVba","393216:24cVba4","786432:cfZaKBs","786432:fZaKBsR","786432:ZaKBsRv","786432:aKBsRvK","786432:KBsRvK3","786432:BsRvK3q","786432:sRvK3qk","786432:RvK3qkA","786432:vK3qkAW","786432:K3qkAW8","786432:3qkAW8w","786432:qkAW8w9","786432:kAW8w9d","786432:AW8w9dQ","786432:W8w9dQf","786432:8w9dQfF","786432:w9dQfF3","786432:9dQfF3M","786432:dQfF3Mn","786432:QfF3MnG","786432:fF3MnG3","786432:F3MnG3w","786432:3MnG3wF","786432:MnG3wFa","786432:nG3wFaC","786432:G3wFaC2","786432:3wFaC24","786432:wFaC24c","786432:FaC24cV","786432:aC24cVb","786432:C24cVba","786432:24cVba4","393216:EaK3DAW","393216:aK3DAW8","393216:K3DAW8w","393216:3DAW8w9","393216:DAW8w9d","393216:W8w9dQd","393216:8w9dQd3","393216:w9dQd3M","393216:9dQd3MG","393216:dQd3MGg","393216:Qd3MGg7","393216:d3MGg72","393216:3MGg724","393216:MGg724Y","393216:Gg724Ya"],"imphash":"965e162fe6366ee377aa9bc80bdd5c65"},"file_info":{"file_name":"WhichApp.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":13633031,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1747331131000,"last_seen":1747331131000,"last_multi_scan":1747331131000}},"detections":{"summary":{"verdict":"malicious","score":80,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":195,"suspicious_count":16,"malicious_count":1,"total":212},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/Win32.Kryptik.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Blocker.tsLO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"RiskWare/Kryptik.a","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"},{"type":"suspicious","value":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WhichApp.exe\" called \"FindResourceW\" with parameter \"140712262882464\" - (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WhichApp.exe\" called \"LoadResource with parameter {'hModule': '140712261713920', 'hResInfo': '140712263154544'}\" (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WhichApp.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"WhichApp.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; File: \"WhichApp.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003760.00000001.115360.2A390000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006616.00000001.114738.4A1F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006616.00000002.116659.4A1F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00003760.00000000.113438.20B98000.00000004.mdmp, 00000000-00003760.00000002.117279.20B98000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"WhichApp.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"WhichApp.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"WhichApp.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WhichApp.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"WhichApp.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"WhichApp.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"msgbox.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"fontchooser.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"scale.tcl\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"_psutil_windows.pyd\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003760-00000C2B-778147932\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"WhichApp.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"WhichApp.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"tkdnd28.dll\")\n file/memory contains long string with (Indicator: \"GetCursorPos\"; File: \"win32api.pyd\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00003760-00000C2B-779543349\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"WhichApp.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00003760-00000C2B-779541931\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"WhichApp.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"WhichApp.exe\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"win32api.pyd\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"win32event.pyd\")\n file/memory contains long string with (Indicator: \"findwindow\"; File: \"tkdnd_generic.tcl\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"WhichApp.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"WhichApp.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WhichApp.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WhichApp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006616)\n \"WhichApp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WhichApp.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006616)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WhichApp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006616)\n \"WhichApp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WhichApp.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: libcrypto-1_1.dll]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: tcl86t.dll]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: WhichApp.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: tcl86t.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: win32api.pyd]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: _psutil_windows.pyd]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; File: \"WhichApp.exe\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; File: \"WhichApp.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolume\"; File: \"WhichApp.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"WhichApp.exe\")\n Found reference to API \"FindVolumeMountPointClose\" (Indicator: \"FindVolumeMountPointClose\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"run_query(\"SELECT * FROM students\") # ok\" (Indicator: \"select * from \"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found string \"run_query(\"SELECT * FROM \" + literal_string) # ok\" (Indicator: \"select * from \"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found string \"f\"SELECT * FROM students WHERE name = {arbitrary_string}\"\" (Indicator: \"select * from \"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"WhichApp.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WhichApp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WhichApp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"fonts.tcl\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"WhichApp.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"WhichApp.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"WhichApp.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"WhichApp.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"WhichApp.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"WhichApp.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c \"ver\"\") in Source: 00000000-00003760-00000C46-11719970226\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp\n 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp\n 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"WhichApp.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; File: \"WhichApp.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"WhichApp.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"WhichApp.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"WhichApp.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"WhichApp.exe\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"WhichApp.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"WhichApp.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"WhichApp.exe\")\n Found reference to API \"VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"WhichApp.exe\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"WhichApp.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"WhichApp.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WhichApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"WhichApp.exe\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"WhichApp.exe\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WhichApp.exe\" called \"CreateProcessW\" with parameter \"\"C:\\WhichApp.exe\"\" - (UID: 00000000-00006616)\n \"WhichApp.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" - (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"WhichApp.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Insert a simple entry into the list of warnings filters (at the front).\" (Source: 00000000-00003760.00000000.113438.2C100000.00000004.mdmp, 00000000-00003760.00000002.117279.2C100000.00000004.mdmp, Indicator: \"insert a simple entry into the list of warnings filters (at the front).\"), \"Insert an entry into the list of warnings filters (at the front).\" (Source: 00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp, Indicator: \"insert an entry into the list of warnings filters (at the front).\"), \"inserts *copies* into it of the objects found in the original.\" (Source: 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp, Indicator: \"inserts *copies* into it of the objects found in the original.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegLoadKeyW\" (Indicator: \"RegLoadKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; File: \"WhichApp.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pywintypes311.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _psutil_windows.pyd)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"WhichApp.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00003760-00000C46-11719970226\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003760-00000C46-11719970226\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"WhichApp.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"WhichApp.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"WhichApp.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"WhichApp.exe\")\n Found reference to API \"?PyWinObject_FreeResourceId@@YAXPEA_W@Z\" (Indicator: \"FreeResource\"; File: \"WhichApp.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WhichApp.exe\")\n Found reference to API \"?PyWinObject_FreeResourceIdA@@YAXPEAD@Z\" (Indicator: \"FreeResource\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"WhichApp.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"WhichApp.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"WhichApp.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"WhichApp.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$30","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\\Debug\" in Source: 00000000-00003760.00000000.113438.20B98000.00000004.mdmp\n 00000000-00003760.00000002.117279.20B98000.00000004.mdmp\n \"Software\\Python\\PythonCore\\{sys_version}\\Modules\\{fullname}\" in Source: 00000000-00003760.00000000.113438.20B98000.00000004.mdmp\n 00000000-00003760.00000002.117279.20B98000.00000004.mdmp\n \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3760:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:120:WilError_01\"\n \"Local\\SM0:3760:304:WilStaging_02\"\n \"SM0:3760:120:WilError_01\"\n \"SM0:3760:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$31","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688\" (Indicator: \"github.com\")\n \"https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py#L24-L25\" (Indicator: \"github.com\")\n \"https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#L81-L97\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readers.py#L11\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L422\" (Indicator: \"github.com\")\n \"https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py#L312\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WhichApp.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 491A0000\n \"WhichApp.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 48440000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 491A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WhichApp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4B810000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4B810000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a006900000040c7e748fa7f0000@ntdll.dll\"\n \"\"#i@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$33","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WhichApp.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$34","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$35","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$36","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$37","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x24d000\" greater than 0x100000\n Raw size of \".text\" is \"0x16b000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x10d400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x24ce94\" greater than 0x100000\n Virtual size of \".text\" is \"0x16ae48\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x10d3d8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"$38","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003760-00000BC0-780148416]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"ver\"\" [Source: 00000000-00003760-00000C46-11719970226]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"WhichApp.exe\" (UID: 00000000-00003760) was launched with new environment variables: \"_PYI_ARCHIVE_FILE=\"C:\\WhichApp.exe\", USERDNSDOMAIN=\"tXGw4RvtZmn711u\", _PYI_APPLICATION_HOME_DIR=\"%TEMP%\\_MEI66162\", _PYI_PARENT_PROCESS_LEVEL=\"0\"\"\n Process \"WhichApp.exe\" (UID: 00000000-00003760) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"cmd.exe\" (UID: 00000000-00004204) was launched with new environment variables: \"TCL_LIBRARY=\"%TEMP%\\_MEI66162\\_tcl_data\", TK_LIBRARY=\"%TEMP%\\_MEI66162\\_tk_data\", HOME=\"C:\\Users\\bAuw3UC\"\"\n Process \"cmd.exe\" (UID: 00000000-00004204) was launched with modified environment variables: \"Path, _PYI_PARENT_PROCESS_LEVEL\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WhichApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WhichApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WhichApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WhichApp.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WhichApp.exe\" (UID: 00000000-00003760)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00004204)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WhichApp.exe\" (UID: 00000000-00003760)\n Spawned process \"cmd.exe\" with commandline \"/c \"ver\"\" (UID: 00000000-00004204)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WhichApp.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI66162\\Pythonwin\\mfc140u.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WhichApp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WhichApp.exe\" queries basic process information of the \"C:\\WhichApp.exe\" (UID: 6616)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WhichApp.exe\" reads file \"c:\\whichapp.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WhichApp.exe\" trying to touch file \"C:\\WHICHAPP.EXE.LOCAL\"\n \"WhichApp.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WhichApp.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WhichApp.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"\n \"WhichApp.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"WhichApp.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WhichApp.exe\" trying to touch file \"C:\\CRYPTSP.DLL\"\n \"WhichApp.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WhichApp.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei66162\\pythonwin\\mfc140u.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WhichApp.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gen_py\\3.11\\dicts.dat\"\n \"WhichApp.exe\" writes a file \"%TEMP%\\gen_py\\3.11\\dicts.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"win32api.pyd\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003760-00000C2B-779542138\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: tcl86t.dll]\n Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: _socket.pyd]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"WhichApp.exe\")\n Found reference to API \"setsockopt(level, optname, value[, optlen]) -- set socket options\" (Indicator: \"setsockopt\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found reference to API \"the setsockopt() and getsockopt() methods.\" (Indicator: \"setsockopt\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"b_tcl_data\\msgs\\es_mx.msg\" [Source: 00000000-00003760.00000000.113438.2A3C0000.00000004.mdmp\n 00000000-00003760.00000001.115360.2A3C0000.00000004.mdmp\n 00000000-00003760.00000002.117279.2A3C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"123.45.67.89\" found in string \"inet_aton() -- convert IP addr string (123.45.67.89) to 32-bit packed format\"\n Potential IP \"123.45.67.89\" found in string \"inet_ntoa() -- convert 32-bit packed format IP to string (123.45.67.89)\"\n Potential IP \"0.0.0.0\" found in string \"was given, it is returned unchanged. If `name` was empty or '0.0.0.0',\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetDCName\" which can \"return the name of the primary domain controller (PDC).\" [Source: tcl86t.dll]\n Observed import api \"NetUserGetInfo\" which can \"retrieve information about a particular user account on a server.\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-1_1.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"WhichApp.exe\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: tcl86t.dll]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: win32api.pyd]\n Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: _psutil_windows.pyd]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"WhichApp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50107ab\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WhichApp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WhichApp.exe\" called \"GetComputerNameW\" (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"WhichApp.exe\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"WhichApp.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"GetDC\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; File: \"WhichApp.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"WhichApp.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: tk86t.dll)\n Found GetCursorPos() in an import section (Source: win32ui.pyd)\n Found GetCursorPos() in an import section (Source: win32api.pyd)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"WhichApp.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"WhichApp.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"WhichApp.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"WhichApp.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"WhichApp.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegNotifyChangeKeyValue\" (Indicator: \"RegNotifyChangeKeyValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegQueryValueW\" (Indicator: \"RegQueryValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; File: \"WhichApp.exe\")\n Found reference to API \"RegSaveKeyW\" (Indicator: \"RegSaveKey\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"WhichApp.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"WhichApp.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"WhichApp.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"WhichApp.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"pythoncom311.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where a nested list appears, it contains classes derived from the class\" (Indicator: \"where \"; Source: \"00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp\")\n Found string \"where the first item is the layout name, and the other\" (Indicator: \"where \"; Source: \"00000000-00003760.00000000.113438.2C5E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C5E0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C5E0000.00000004.mdmp\")\n Found string \"Where there is no registered implementation for a specific type, its method\" (Indicator: \"where \"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"WhichApp.exe\")\n Found reference to API \"VkKeyScanW\" (Indicator: \"VkKeyScan\"; File: \"WhichApp.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"WhichApp.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"WhichApp.exe\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"WhichApp.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"WhichApp.exe\")\n Found reference to API \"VkKeyScanExA\" (Indicator: \"VkKeyScan\"; File: \"WhichApp.exe\")\n Found reference to API \"VkKeyScanExW\" (Indicator: \"VkKeyScan\"; File: \"WhichApp.exe\")\n Found reference to API \"VkKeyScanA\" (Indicator: \"VkKeyScan\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"Dir lib\" (Indicator: \"dir \"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found string \"Dir\" (Indicator: \"dir\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp\")\n Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000000.113438.2D220000.00000004.mdmp, 00000000-00003760.00000001.115360.2D220000.00000004.mdmp, 00000000-00003760.00000002.117279.2D220000.00000004.mdmp\")\n Found string \"dir ${na\" (Indicator: \"dir \"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"WhichApp.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"WhichApp.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"WhichApp.exe\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"WhichApp.exe\")\n Found reference to API \"gethostname() -- return the current hostname\" (Indicator: \"gethostname\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found reference to API \"hostname from gethostname() is returned.\" (Indicator: \"gethostname\"; Source: \"00000000-00003760.00000000.113438.2CBD0000.00000004.mdmp, 00000000-00003760.00000002.117279.2CBD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"WhichApp.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"WhichApp.exe\")\n Found reference to API \"getsockname() -- return local address\" (Indicator: \"getsockname\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000000.113438.3E798000.00000002.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"WhichApp.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"WhichApp.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"WhichApp.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"WhichApp.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"WhichApp.exe\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"WhichApp.exe\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.412D0000.00000002.mdmp, 00000000-00003760.00000002.117279.2308C000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$45","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$46","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: WhichApp.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: tkdnd28.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"WhichApp.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"win32api.pyd\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"_psutil_windows.pyd\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"WhichApp.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"WhichApp.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003760)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: WhichApp.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: tcl86t.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: win32api.pyd]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: _psutil_windows.pyd]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\WhichApp.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003760.00000000.113438.2A3C0000.00000004.mdmp, 00000000-00003760.00000001.115360.2A3C0000.00000004.mdmp, 00000000-00003760.00000001.115360.2C9D0000.00000004.mdmp, 00000000-00003760.00000002.117279.2A3C0000.00000004.mdmp, 00000000-00003760.00000002.117279.2C9D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003760.00000000.113438.2A3C0000.00000004.mdmp, 00000000-00003760.00000001.115360.2A3C0000.00000004.mdmp, 00000000-00003760.00000002.117279.2A3C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp\n 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"WhichApp.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"WhichApp.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"WhichApp.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"WhichApp.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"WhichApp.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"WhichApp.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003760.00000000.113438.2C9D0000.00000004.mdmp, 00000000-00003760.00000001.115360.35B5B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: WhichApp.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WhichApp.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2324C000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp, 00000000-00003760.00000001.115360.2D802000.00000002.mdmp, 00000000-00003760.00000002.117279.0995C000.00000002.mdmp, 00000000-00003760.00000002.117279.209D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WhichApp.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"BFD6FAEBFBC5DB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$49","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownW\" (Indicator: \"InitiateSystemShutdown\"; File: \"WhichApp.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"WhichApp.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003760.00000000.113438.2C6E0000.00000004.mdmp, 00000000-00003760.00000000.113438.32D73000.00000002.mdmp, 00000000-00003760.00000001.115360.2C6E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"WhichApp.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"WhichApp.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"WhichApp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"libcrypto-1_1.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"python3.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WhichApp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"WhichApp.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00006616)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\"\n Pattern match: \"guido@python.org\"\n Pattern match: \"yselivanov@sprymix.com\"\n Pattern match: \"ping@lfw.org\"\n Pattern match: \"nadeem.vawda@gmail.com\"\n Pattern match: \"info@egenix.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"WhichApp.exe\" writes archive file \"%TEMP%\\_MEI66162\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4d","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WhichApp.exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI66162\\Pythonwin\\mfc140u.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"python311.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-1_1.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"python311.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-1_1.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$4e","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 958 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"161\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"144\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"145\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"WhichApp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"WhichApp.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"BFD6FAEBFBC5DB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$50","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$51","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"VCRUNTIME140.dll\" claims program is from Sun Aug 4 18:57:49 2097\n \"VCRUNTIME140_1.dll\" claims program is from Tue Sep 24 08:05:17 2069","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WhichApp.exe\" wrote 00000FB8 bytes to a remote process \"C:\\WhichApp.exe\" (Handle: 388)\n \"WhichApp.exe\" wrote 00000008 bytes to a remote process \"C:\\WhichApp.exe\" (Handle: 388)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":243,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"68262839b0c52a5d1a0c198b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"WhichApp.exe","analysis_start_time":"2025-05-15T17:45:32+00:00","indicators_count":{"informative":195,"suspicious":38,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}],"processes":[{"pid":6616,"ppid":0,"name":"WhichApp.exe","command_line":"","sha256":"299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","normalized_path":"C:\\WhichApp.exe","uid":"00000000-00006616","icon":"$52"},{"pid":3760,"ppid":6616,"name":"WhichApp.exe","command_line":"","sha256":"299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920","normalized_path":"C:\\WhichApp.exe","parent_uid":"00000000-00006616","uid":"00000000-00003760"},{"pid":4204,"ppid":3760,"name":"cmd.exe","command_line":"/c \"ver\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003760","uid":"00000000-00004204"}],"all_imported_dlls":["gdi32full.dll","fltLib.dll","IPHLPAPI.DLL","dxgi.dll","rmclient.dll","imm32.dll","python311.dll","VCRUNTIME140_1.dll","iertutil.dll","msvcp_win.dll","ws2_32.dll","comdlg32.dll","samcli.dll","pywintypes311.dll","ntmarta.dll","bcryptprimitives.dll","windows.storage.dll","pdh.dll","cldapi.dll","user32.dll","advapi32.dll","oleaut32.dll","imagehlp.dll","secur32.dll","sspicli.dll","CoreUIComponents.dll","VCRUNTIME140.dll","logoncli.dll","d3d11.dll","KernelBase.dll","ucrtbase.dll","VxSSL64.dll","msctf.dll","bcrypt.dll","shell32.dll","gdi32.dll","shlwapi.dll","tk86t.dll","powrprof.dll","rpcrt4.dll","profapi.dll","netapi32.dll","DataExchange.dll","dcomp.dll","version.dll","SHCore.dll","wtsapi32.dll","ntdll.dll","comctl32.dll","combase.dll","cryptsp.dll","ole32.dll","userenv.dll","cryptbase.dll","TextInputFramework.dll","libffi-8.dll","kernel.appcore.dll","psapi.dll","tkdnd28.dll","aepic.dll","WinTypes.dll","msvcrt.dll","uxtheme.dll","urlmon.dll","pythoncom311.dll","win32u.dll","dwmapi.dll","tcl86t.dll","cfgmgr32.dll","netutils.dll","twinapi.appcore.dll","kernel32.dll","sechost.dll","python3.dll","clbcatq.dll","CoreMessaging.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"mfc140u.dll","sha256":"2006e0f811c5ab2d281e3b6a34161c1ac4365b634ab91e1a49e969488cebbe0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"VCRUNTIME140.dll","sha256":"d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_bz2.pyd","sha256":"5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_decimal.pyd","sha256":"d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_lzma.pyd","sha256":"613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_socket.pyd","sha256":"39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"libcrypto-1_1.dll","sha256":"976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"python311.dll","sha256":"937dbb75b30c9f1262deadf308199c3afb32e72ef73f499b4edb093d70b02904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"pythoncom311.dll","sha256":"1b1663859d7ee7ca0fcd5328a9d9a57b0d7f03e2a82a026e4749aeed97bac119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"tcl86t.dll","sha256":"a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"tk86t.dll","sha256":"20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"tkdnd28.dll","sha256":"574369fbd0d8c299dfa1f47201c555f0441232ac9fe8f728c1c02a1dd792d38c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"win32ui.pyd","sha256":"629e9120f53fdcfa989fe4d0ddb095ff8f91637fdd8927b34a15162f3ba931f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"VCRUNTIME140_1.dll","sha256":"1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_ctypes.pyd","sha256":"e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"_hashlib.pyd","sha256":"39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"auto.tcl","sha256":"517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"clock.tcl","sha256":"1947f8b188ab4ab6aa72ea68a58d2d9add0894fdf320f6b074eae0f198368fb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"ascii.enc","sha256":"fb87bf197f4f485b08ea81f7534bc07d9c3a538d022424be11011a1fe3c413fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"big5.enc","sha256":"ad1ed201b69855bfd353bf969dfc55576da35a963abf1bf7fc6d8b5142a61a61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cns11643.enc","sha256":"8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cp1250.enc","sha256":"e2991a6f7a7a4d8d3c4c97947298fd5bacb3eaa2f898cee17f5e21a9861b9626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cp1251.enc","sha256":"0aa66dff8a7ae570fee83a803f8f5391d9f0c9bd6311796592d9b6e8e36be6fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cp1252.enc","sha256":"741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cp1253.enc","sha256":"5b8d47451f847c1bde12caca3739ca29860553c0b6399ee990d51b26f9a69722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"cp1254.enc","sha256":"31639ca96a4d3602d59bd012540fe179917e0561cb11a0d0b61f1b950eb76911","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"libffi-8.dll","sha256":"128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"python3.dll","sha256":"4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"pywintypes311.dll","sha256":"074a73db77cbd9a8a1eed34dbfeddcea2d5772d34f8761b94957ae463c9a16ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}],"files_written":[{"path":"%TEMP%\\_MEI66162\\Pythonwin\\mfc140u.dll","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\Pythonwin\\win32ui.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\VCRUNTIME140_1.dll","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cns11643.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-11.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\symbol.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\encoding\\tis-620.enc","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\history.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\http1.0\\http.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\init.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\af.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\af_za.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ar.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ar_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ar_jo.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ar_lb.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ar_sy.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\be.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\bg.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\bn.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\bn_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ca.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\cs.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\da.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\de.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\de_at.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\de_be.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\el.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_au.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_be.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_bw.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_ca.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_gb.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_hk.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_ie.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_nz.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_ph.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_sg.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_za.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\en_zw.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\eo.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_ar.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_bo.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_cl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_co.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_cr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_do.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_ec.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_gt.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_hn.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_mx.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_ni.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_pa.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_pe.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_pr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_py.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_sv.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_uy.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\es_ve.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\et.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\eu.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\eu_es.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fa.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fa_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fa_ir.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fi.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fo.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fo_fo.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fr_be.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fr_ca.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\fr_ch.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ga.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ga_ie.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\gl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\gl_es.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\gv.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\gv_gb.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\he.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\hi.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\hi_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\hr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\hu.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\id.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\id_id.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\is.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\it.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\it_ch.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ja.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kl_gl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ko.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ko_kr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kok.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kok_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kw.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\kw_gb.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\lt.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\lv.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\mk.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\mr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\mr_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ms.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ms_my.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\mt.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\nb.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\nl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\nl_be.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\nn.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\pl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\pt.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\pt_br.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ro.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ru.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ru_ua.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sh.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sk.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sl.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sq.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sv.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\sw.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ta.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\ta_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\te.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\te_in.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\th.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\tr.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\uk.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\vi.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\zh.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\zh_cn.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\zh_hk.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\zh_sg.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\msgs\\zh_tw.msg","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\opt0.4\\optparse.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\opt0.4\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\package.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\parray.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\safe.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tclIndex","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tm.tcl","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Abidjan","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Accra","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Addis_Ababa","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Algiers","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Asmara","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Asmera","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Bamako","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Bangui","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Banjul","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Bissau","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\_MEI66162\\_tcl_data\\tzdata\\Africa\\Blantyre","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\gen_py\\3.11\\__init__.py","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"path":"%TEMP%\\gen_py\\3.11\\dicts.dat","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"Local\\SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"SM0:3760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]},{"name":"SM0:3760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68262839b0c52a5d1a0c198b"}]}]}},"report_ids":{"sandbox_job_ids":["68262839b0c52a5d1a0c198b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious RiskWare/Kryptik.a Sample 299c30d7d034… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 299c30d7d034…. Malware family: RiskWare/Kryptik.a. Threat score 80/100. 3/26 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920"}],["$","meta","4",{"property":"og:title","content":"Malicious RiskWare/Kryptik.a Sample 299c30d7d034… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 299c30d7d034…. Malware family: RiskWare/Kryptik.a. Threat score 80/100. 3/26 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/299c30d7d0344348bc424633cca7a198c7a9fb440febcf560fc845bdc14c1920"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious RiskWare/Kryptik.a Sample 299c30d7d034… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 299c30d7d034…. Malware family: RiskWare/Kryptik.a. Threat score 80/100. 3/26 AV engines flagged this file. 1 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]