24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 3bdb6d2cc212… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3bdb6d2cc212…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96"],"about":{"@type":"SoftwareApplication","name":"TASCJBAO.msi","applicationCategory":["msi","data"],"identifier":"3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1554,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")26:Td3d,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")27:T455,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")28:T175d,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")29:T725,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")2a:T474,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")2b:T517,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "WS_Log.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "WS_Log.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")2c:T110c,Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002188-00000CC3-2942202221") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000001.254465.087B0000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")2d:T562,Found PE header "MZ" - Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000001.254465.05180000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000001.254465.08610000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000002.256383.05180000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000001.252470.045F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000001.252470.0A913000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000001.252470.0B240000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000001.252470.0B30A000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005692.00000002.253295.045F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006268.00000001.253401.03140000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006268.00000001.253401.05322000.00000004.mdmp")2e:T9de,"PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER32") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCHANDLER") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER32") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LOCALSERVER") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\ELEVATION") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "PFramework.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "PFramework.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32")2f:T5ae,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Reads cryptocurrency-related registry keys Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content)30:T8ade,Found XOR loop in file "Hub_Bandwidth64.exe" at offset 895576; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 951632; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1300938; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1301048; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1346820; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1580203; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1582225; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1584523; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1584651; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1590551; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1594431; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1603193; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1610959; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1611781; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1612687; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1618315; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1624005; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1636807; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1641125; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1641635; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1647335; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1649397; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1651735; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1653963; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1654231; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1655453; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1656631; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1658207; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1661871; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1663991; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1667343; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1668907; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1669363; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1672011; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1673295; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1673899; code bytes = 30d0 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1611153; code bytes = 33c1 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1633215; code bytes = 33c1 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1645495; code bytes = 33c1 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1652403; code bytes = 33c1 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 299679; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 316838; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 326655; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 413137; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 430353; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 500227; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 865832; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 867998; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 869711; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1019598; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1027470; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1037415; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1044027; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1053998; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1064459; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1086131; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1162036; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1179640; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1358964; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1359034; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1359061; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1364513; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1400469; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1495826; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1518974; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1546582; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1579070; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1580188; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1582954; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1585416; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1586586; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1590534; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1590950; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1594392; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1596814; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1601436; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1607508; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1612648; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1614072; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1616762; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1618276; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1619886; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1623976; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1626094; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1628454; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1630292; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1630870; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1641596; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1642516; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1644970; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1647296; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1651718; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1652824; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1655438; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1658942; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1661052; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1663952; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1665168; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1668888; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1669326; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1671972; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 1676579; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2498220; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2498467; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2500288; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2505889; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2508698; code bytes = 8030 Found XOR loop in file "Hub_Bandwidth64.exe" at offset 2508945; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 341591; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2301690; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2451231; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2451701; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2459653; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2467413; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2470299; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2473681; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2474147; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2475029; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2477421; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 2479527; code bytes = 30d0 Found XOR loop in file "WsBurn.dll" at offset 39700; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 40321; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 214311; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 214315; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 266994; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 267051; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 267061; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 422287; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 422292; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 699228; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 713383; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2318597; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2319045; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2319621; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2320069; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2320805; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2321253; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2321829; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2322277; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2327226; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2450259; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2454129; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 2463897; code bytes = 33c1 Found XOR loop in file "WsBurn.dll" at offset 695483; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 714835; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 738835; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 751123; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 1450293; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 1510412; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2246141; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2304652; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2317002; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2451932; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2460130; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2467376; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2473160; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2474114; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2474992; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2475442; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2476892; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2478398; code bytes = 8030 Found XOR loop in file "WsBurn.dll" at offset 2479488; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 933107; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 935691; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 937743; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 939147; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 940795; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 942047; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 945527; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 948861; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 953707; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 954051; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 955179; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 957217; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 966061; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 967583; code bytes = 30d0 Found XOR loop in file "DBGHelp.dll" at offset 425234; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 725345; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 738201; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 848959; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 951855; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 957883; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 959655; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 961753; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 962039; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 963283; code bytes = 33c1 Found XOR loop in file "DBGHelp.dll" at offset 583601; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 931808; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 933068; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 935652; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 937704; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 939108; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 940756; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 941408; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 943500; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 948740; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 954714; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 959608; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 963142; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 966800; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 967456; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 987908; code bytes = 8030 Found XOR loop in file "DBGHelp.dll" at offset 990442; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 889687; code bytes = 30d0 Found XOR loop in file "PFramework.exe" at offset 893821; code bytes = 30d0 Found XOR loop in file "PFramework.exe" at offset 894319; code bytes = 30d0 Found XOR loop in file "PFramework.exe" at offset 901391; code bytes = 30d0 Found XOR loop in file "PFramework.exe" at offset 49017; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 49050; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 76359; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 76366; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 77051; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 77058; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 77746; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 77753; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 78465; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 78472; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 79274; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 92100; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 92107; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 95873; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 95880; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 99656; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 99663; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 102755; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 102762; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 122066; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 140136; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 144763; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 144770; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 145484; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 145491; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 146210; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 146217; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 146949; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 146956; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 147772; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 147779; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 160642; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 160649; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 164227; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 164234; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 167824; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 167831; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 494381; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 494416; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 495463; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 495498; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 571976; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 571998; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 573062; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 573076; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 573375; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 573401; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 575134; code bytes = 33c1 Found XOR loop in file "PFramework.exe" at offset 413448; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 482420; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 894290; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 897050; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 901372; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 909861; code bytes = 8030 Found XOR loop in file "PFramework.exe" at offset 917898; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 28812; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 37750; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 280871; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 315059; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 316181; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 317147; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 34975; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 35106; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 266601; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 313049; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 144820; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 157178; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 285023; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 288820; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 288920; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 315040; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 317128; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 324884; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 328132; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 328379; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 334685; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 337284; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 337531; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 291295; code bytes = 30d0 Found XOR loop in file "BugSplat.dll" at offset 294303; code bytes = 30d0 Found XOR loop in file "BugSplat.dll" at offset 44155; code bytes = 33c1 Found XOR loop in file "BugSplat.dll" at offset 44307; code bytes = 33c1 Found XOR loop in file "BugSplat.dll" at offset 171951; code bytes = 33c1 Found XOR loop in file "BugSplat.dll" at offset 289831; code bytes = 33c1 Found XOR loop in file "BugSplat.dll" at offset 116274; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 121688; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 287542; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 289112; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 294284; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 296188; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 299268; code bytes = 8030 Found XOR loop in file "BugSplat.dll" at offset 301802; code bytes = 8030 Found XOR loop in file "NLEService.dll" at offset 233040; code bytes = 30d0 Found XOR loop in file "NLEService.dll" at offset 285913; code bytes = 30d0 Found XOR loop in file "NLEService.dll" at offset 288703; code bytes = 30d0 Found XOR loop in file "NLEService.dll" at offset 71380; code bytes = 33c1 Found XOR loop in file "NLEService.dll" at offset 148964; code bytes = 33c1 Found XOR loop in file "NLEService.dll" at offset 149585; code bytes = 33c1 Found XOR loop in file "NLEService.dll" at offset 163258; code bytes = 33c1 Found XOR loop in file "NLEService.dll" at offset 283841; code bytes = 33c1 Found XOR loop in file "NLEService.dll" at offset 151665; code bytes = 8030 Found XOR loop in file "NLEService.dll" at offset 278550; code bytes = 8030 Found XOR loop in file "NLEService.dll" at offset 278780; code bytes = 8030 Found XOR loop in file "NLEService.dll" at offset 279776; code bytes = 8030 Found XOR loop in file "NLEService.dll" at offset 287838; code bytes = 8030 Found XOR loop in file "WS_ImageProc.dll" at offset 149786; code bytes = 30d0 Found XOR loop in file "WS_ImageProc.dll" at offset 221511; code bytes = 30d0 Found XOR loop in file "WS_ImageProc.dll" at offset 222229; code bytes = 30d0 Found XOR loop in file "WS_ImageProc.dll" at offset 57863; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 58484; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 142021; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 142469; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 143045; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 143493; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 144325; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 144773; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 145349; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 145797; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 169018; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 175194; code bytes = 33c1 Found XOR loop in file "WS_ImageProc.dll" at offset 135788; code bytes = 8030 Found XOR loop in file "WS_ImageProc.dll" at offset 150876; code bytes = 8030 Found XOR loop in file "WS_ImageProc.dll" at offset 163226; code bytes = 8030 Found XOR loop in file "WS_ImageProc.dll" at offset 221500; code bytes = 8030 Found XOR loop in file "WS_Log.dll" at offset 58837; code bytes = 33c1 Found XOR loop in file "WS_Log.dll" at offset 59458; code bytes = 33c1 Found XOR loop in file "WS_Log.dll" at offset 219746; code bytes = 8030 Found XOR loop in file "WSUtilities.dll" at offset 178955; code bytes = 30d0 Found XOR loop in file "WSUtilities.dll" at offset 181315; code bytes = 30d0 Found XOR loop in file "WSUtilities.dll" at offset 77172; code bytes = 33c1 Found XOR loop in file "WSUtilities.dll" at offset 77793; code bytes = 33c1 Found XOR loop in file "WSUtilities.dll" at offset 175853; code bytes = 33c1 Found XOR loop in file "WSUtilities.dll" at offset 176407; code bytes = 33c1 Found XOR loop in file "WSUtilities.dll" at offset 177974; code bytes = 8030 Found XOR loop in file "NLEResource.dll" at offset 164367; code bytes = 30d0 Found XOR loop in file "NLEResource.dll" at offset 164579; code bytes = 30d0 Found XOR loop in file "NLEResource.dll" at offset 164937; code bytes = 30d0 Found XOR loop in file "NLEResource.dll" at offset 53284; code bytes = 33c1 Found XOR loop in file "NLEResource.dll" at offset 53905; code bytes = 33c1 Found XOR loop in file "NLEResource.dll" at offset 160735; code bytes = 33c1 Found XOR loop in file "NLEResource.dll" at offset 164180; code bytes = 8030 Found XOR loop in file "NLEResource.dll" at offset 164328; code bytes = 8030 Found XOR loop in file "ExceptionHandler.dll" at offset 43572; code bytes = 33c1 Found XOR loop in file "ExceptionHandler.dll" at offset 44193; code bytes = 33c1 Found XOR loop in file "ExceptionHandler.dll" at offset 126782; code bytes = 8030 Found XOR loop in file "NLETransitionMgr.dll" at offset 1058; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1407; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1505; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1600; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1681; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1793; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 1921; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2097; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2192; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2273; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2369; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2464; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 2545; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 3528; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 3937; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 10495; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 10838; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 11807; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 11889; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 11986; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 12111; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 12191; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 12271; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 12416; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 12630; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 13585; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 13992; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 14488; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 14783; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 14946; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 15170; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 16786; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 17013; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 18280; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 19111; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 19649; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 19857; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 20147; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 21135; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 21546; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 22322; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 22337; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 23265; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 23633; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 23839; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 24496; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 24808; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 25513; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 25720; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 26550; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 26886; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 27037; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 27261; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 27696; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 28646; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 30198; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 31389; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 32006; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 32117; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 32168; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 32506; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 37062; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 37154; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 37428; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 37515; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 42929; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 45672; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 45796; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 54496; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 55319; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 57279; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 59345; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 65137; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 65460; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 67422; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 68201; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 69339; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 71861; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 71934; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 74389; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 75759; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 75946; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 76566; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 76734; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 77282; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 80492; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 82276; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 85701; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 88335; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 88415; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 104004; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 122809; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 123235; code bytes = 30d0 Found XOR loop in file "NLETransitionMgr.dll" at offset 31396; code bytes = 33c1 Found XOR loop in file "NLETransitionMgr.dll" at offset 32017; code bytes = 33c1 Found XOR loop in file "COMSupport.dll" at offset 57471; code bytes = 30d0 Found XOR loop in file "COMSupport.dll" at offset 8756; code bytes = 33c1 Found XOR loop in file "COMSupport.dll" at offset 9377; code bytes = 33c1 Found XOR loop in file "COMSupport.dll" at offset 55440; code bytes = 8030 Found XOR loop in file "COMSupport.dll" at offset 57276; code bytes = 8030 Found XOR loop in file "DVDSetting.dll" at offset 38935; code bytes = 30d031:T605,file/memory contains long string with (Indicator: "GetCommandLine"; File: "Crisp.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "NLEService.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WS_ImageProc.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WS_Log.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WSUtilities.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "NLEResource.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "ExceptionHandler.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "NLETransitionMgr.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "COMSupport.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DVDSetting.dll") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00002188-00000C2C-2945955568") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp")32:T61b,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002188-00000C2C-2931267455") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002188-00000C2C-2931267625") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002188-00000C2C-2942680086") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00002188-00000C2C-2942680110") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSidEx" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")33:Tb41,Found system information discovery API: "GetMonitorInfoA" in file "00000000-00005692.00000002.253295.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in file "00000000-00005692.00000002.253295.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "NtWow64GetNativeSystemInformation" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found system information discovery API: "ZwWow64GetNativeSystemInformation" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp"34:T762,"PFramework.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002188) "Crisp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000145cad370000fe0268e9f5001dfae57718f1f500a0188c72b055d545feffffff88f0f5005c7f8a7238f0f500f0f0f50000000000757f8a72f0f0f500ffffffffffffffff2300000000000000f0f0f500000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff2300000000000000f0f0f500000000001c000000000000000000000000000000000000000c5cad3728f1f500 (UID: 00000000-00006268) "Crisp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006268)35:T1c0c,"PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000016000016a53b000010e4470350ab460310000000f0e947030100000003000000010000000c0000000000000000000000000000000100000001000000000000000000000065002e0064006c000000000000000000000000000000000001ab00002f0000000000000000000000a067397330523b7300b00a0000000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812340600004603000400001800000000000000000000000300000002000000000046030c00000000000000000000005ce42f01ee13e47728123406ee13e47700000000000000000c00000040994f030100000074e42f012823377300004603000000000c000000ac407c0680e42f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603c0f24d031800000000000000000000000300000002000000000046030c0000000000000078a94c756ce52f01ee13e47728123406ee13e47700000000000000000c0000006f0137712812340684e52f012823377300004603000000000c0000000832167390e52f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603000000001800000000000000000000000300000002000000000046030c0000000000000000e62f01dce52f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f010c954f03f4e52f012823377300004603000000000c00000030a5167300e62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812340600004603000400001800000000000000000000000300000002000000000046030c00000000000000000000005ce42f01ee13e47728123406ee13e47700000000000000000c00000040e84e030100000074e42f012823377300004603000000000c000000dc7c7c0680e42f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603e8ef4d031800000000000000000000000300000002000000000046030c0000000000000078a94c756ce52f01ee13e47728123406ee13e47700000000000000000c0000006f0137712812340684e52f012823377300004603000000000c0000000832167390e52f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603000000001800000000000000000000000300000002000000000046030c0000000000000000e62f01dce52f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f01bce84e03f4e52f012823377300004603000000000c00000030a5167300e62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812340600004603000400001800000000000000000000000300000002000000000046030c00000000000000000000005ce42f01ee13e47728123406ee13e47700000000000000000c00000030e94e030100000074e42f012823377300004603000000000c000000e89e7c0680e42f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000460330617f081800000000000000000000000300000002000000000046030c0000000000000078a94c7564e52f01ee13e47728123406ee13e47700000000000000000c0000006f013771281234067ce52f012823377300004603000000000c0000000832167388e52f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603000000001800000000000000000000000300000002000000000046030c0000000000000000e62f01dce52f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f015ce94e03f4e52f012823377300004603000000000c00000030a5167300e62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812340600004603000400001800000000000000000000000300000002000000000046030c0000000000000000000000c4e52f01ee13e47728123406ee13e47700000000000000000c00000030a0890801000000dce52f012823377300004603000000000c000000e8ae8206e8e52f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016e4770c000000000000000000000000004603100000001800000000000000000000000300000002000000000046030c0000000000000084e62f0170e62f01ee13e47700000000ee13e47700000000000000000c000000ffff367188e62f012823377300004603000000000c0000000832167394e62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603000000001800000000000000000000000300000002000000000046030c0000000000000050e72f012ce72f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f01b86c360644e72f012823377300004603000000000c00000030a5167350e72f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812340600004603000400001800000000000000000000000300000002000000000046030c0000000000000000000000e4e52f01ee13e47728123406ee13e47700000000000000000c000000f0a3890801000000fce52f012823377300004603000000000c00000058dd820608e62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016e4770c000000000000000000000000004603100000001800000000000000000000000300000002000000000046030c000000000000002ce62f0118e62f01ee13e47700000000ee13e47700000000000000000c000000ffff367130e62f012823377300004603000000000c000000083216733ce62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016e4770c000000000000000000000000004603f0a389081800000000000000000000000300000002000000000046030c00000000000000c725847238e72f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f0150e72f012823377300004603000000000c00000030a516735ce72f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016e4770c000000000000002812340600004603000000001800000000000000000000000300000002000000000046030c0000000000000000000000e8e52f01ee13e47728123406ee13e47700000000000000000c000000f0a3890800e62f012823377300004603000000000c000000801983060ce62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016e4770c000000000000000000000000004603100000001800000000000000000000000300000002000000000046030c000000000000007ce62f0168e62f01ee13e47700000000ee13e47700000000000000000c000000ffff367180e62f012823377300004603000000000c000000083216738ce62f012f9916730c000000 (UID: 00000000-00002188) "PFramework.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000004603000000001800000000000000000000000300000002000000000046030c0000000000000060e72f013ce72f01ee13e47700000000ee13e47700000000000000000c000000e0ea2f01c43d657254e72f012823377300004603000000000c00000030a5167360e72f012f9916730c000000 (UID: 00000000-00002188)36:T9b2,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")37:T720,"PFramework.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")38:T8c4,"PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "PFramework.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")39:T50b,"PFramework.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "PFramework.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3a:T277b,"PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrcompression.dll (UID: 00000000-00002188) "PFramework.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002188) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006268) "Crisp.exe" called "LoadLibrary" with a parameter xmllite.dll (UID: 00000000-00006268)3b:Ta8d4,"PFramework.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SysAllocStringByteLen (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipGetImageDecodersSize (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipGetImageDecoders (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetForegroundWindowW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter deflateInit2_ (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter deflate (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter deflateEnd (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter inflateInit2_ (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter inflate (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter zlibCompileFlags (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00002188) "PFramework.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002188) "Crisp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006268) "Crisp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006268)3c:T65b,Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")3d:T88e,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")3e:T98f,Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")3f:T1245,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")40:T69e,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")41:T2472,"SOFTWARE\Borland\Delphi\RTL" in Source: 64791-49-00403D4C "Software\CodeGear\Locales" in Source: 64791-150-004081F0 "Software\Borland\Locales" in Source: 64791-150-004081F0 "Software\Borland\Delphi\Locales" in Source: 64791-150-004081F0 "\Software\CLASSES\CLSID\%s\Info" in Source: 64791-977-004D35C0 "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 64791-1490-004862B8 "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 64791-5590-0043EB78 "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 64791-5868-0045E03C "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00002188-00000C2E-53596972160 "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002188.00000001.254465.03460000.00000004.mdmp 00000000-00002188.00000002.256383.03460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002188.00000001.254465.03460000.00000004.mdmp 00000000-00002188.00000002.256383.03460000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp 00000000-00002188.00000002.256383.05596000.00000004.mdmp42:T91e9,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002188.00000001.254465.03460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002188.00000001.254465.03460000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002188.00000002.256383.03460000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002188.00000002.256383.03460000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00002188.00000002.256383.05596000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002188.00000002.256383.089F0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002188.00000002.256383.089F0000.00000004.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00005692.00000000.250550.4002B000.00000002.mdmp "Software\Microsoft\CTF\LayoutIcon" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\InputDll" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\DirectSwitchHotkeys" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\AssemblyItem" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\Language" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\HiddenDummyLayouts" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\Assemblies" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\TIP" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%08x" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\LocalServer32" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\CTF\TIP\%s\LanguageProfile\0x0000%04x\%s" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\Internet Explorer\International" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "S-1-5-20\Software\Microsoft\CTF" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "S-1-5-19\Software\Microsoft\CTF" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp ".DEFAULT\Software\Microsoft\CTF" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP\" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\MSCTF" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "System\ControlSet001\Control\Keyboard Layouts" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\Locale" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "System\ControlSet001\Control\Nls\Locale" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005692.00000001.252470.029E0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00005692.00000001.252470.0A913000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00005692.00000001.252470.0B0A7000.00000004.mdmp "Software\BugSplat" in Source: 00000000-00005692.00000001.252470.10037000.00000002.mdmp "Software\BugSplat\%s\%s\%s" in Source: 00000000-00005692.00000001.252470.10037000.00000002.mdmp "SOFTWARE\Rocket Division Software\StarBurn" in Source: 00000000-00005692.00000001.252470.72B36000.00000002.mdmp "SOFTWARE\Rocket Division Software\StarWave" in Source: 00000000-00005692.00000001.252470.72B36000.00000002.mdmp "Software\Borland\Locales" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "\Software\CLASSES\CLSID\%s\Info" in Source: 00000000-00005692.00000002.253295.00401000.00000020.mdmp "Software\Microsoft\CTF\LayoutIcon" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\InputDll" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\DirectSwitchHotkeys" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\AssemblyItem" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\Language" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\HiddenDummyLayouts" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\Assemblies" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\TIP" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%08x" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\LocalServer32" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\CTF\TIP\%s\LanguageProfile\0x0000%04x\%s" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\Internet Explorer\International" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "S-1-5-20\Software\Microsoft\CTF" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "S-1-5-19\Software\Microsoft\CTF" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp ".DEFAULT\Software\Microsoft\CTF" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP\" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\MSCTF" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "System\ControlSet001\Control\Keyboard Layouts" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\Locale" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "System\ControlSet001\Control\Nls\Locale" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005692.00000002.253295.029E0000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005692.00000002.253295.73364000.00000002.mdmp "SoftWare\Digital River\SoftwarePassport\" in Source: 00000000-00005692.00000002.253295.73364000.00000002.mdmp " Software\" in Source: 00000000-00005692.00000002.253295.73364000.00000002.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00006268.00000001.253401.05322000.00000004.mdmp43:T44c,"PFramework.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77c20000 "PFramework.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77c20000 "PFramework.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77c20000 "PFramework.exe" loaded module "KERNEL32" at base 74a10000 "PFramework.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72840000 "PFramework.exe" loaded module "MSVCRT.DLL" at base 75a10000 "PFramework.exe" loaded module "RPCRT4.DLL" at base 77330000 "PFramework.exe" loaded module "USER32.DLL" at base 75890000 "Crisp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77c20000 "Crisp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77c20000 "Crisp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77c20000 "Crisp.exe" loaded module "KERNEL32" at base 74a10000 "Crisp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72840000 "Crisp.exe" loaded module "MSVCRT.DLL" at base 75a10000 "Crisp.exe" loaded module "RPCRT4.DLL" at base 77330000 "Crisp.exe" loaded module "USER32.DLL" at base 7589000044:T9d0,"TASCJBAO.msi" was detected as "Microsoft Installer(MSI)" and name: "Installer" "TASCJBAO.msi" was detected as "Microsoft Compound" and name: "Data" "Hub_Bandwidth64.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Hub_Bandwidth64.exe" was detected as "Microsoft Compound" and name: "Data" "WsBurn.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "WsBurn.dll" was detected as "Microsoft Compound" and name: "Data" "DBGHelp.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "DBGHelp.dll" was detected as "Microsoft Compound" and name: "Data" "PFramework.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "PFramework.exe" was detected as "Microsoft Compound" and name: "Data" "Crisp.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Crisp.exe" was detected as "Microsoft Compound" and name: "Data" "BugSplat.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "BugSplat.dll" was detected as "Microsoft Compound" and name: "Data" "NLEService.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "NLEService.dll" was detected as "Microsoft Compound" and name: "Data" "WS_ImageProc.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "WS_ImageProc.dll" was detected as "Microsoft Compound" and name: "Data" "WS_Log.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "WS_Log.dll" was detected as "Microsoft Compound" and name: "Data" "WSUtilities.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "WSUtilities.dll" was detected as "Microsoft Compound" and name: "Data" "NLEResource.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "NLEResource.dll" was detected as "Microsoft Compound" and name: "Data" "ExceptionHandler.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "ExceptionHandler.dll" was detected as "Microsoft Compound" and name: "Data" "NLETransitionMgr.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "NLETransitionMgr.dll" was detected as "Microsoft Compound" and name: "Data" "COMSupport.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "COMSupport.dll" was detected as "Microsoft Compound" and name: "Data" "DVDSetting.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "DVDSetting.dll" was detected as "Microsoft Compound" and name: "Data"45:T6b0,"PFramework.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "PFramework.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "PFramework.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "PFramework.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "PFramework.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "PFramework.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "PFramework.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "PFramework.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "PFramework.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Crisp.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "Crisp.exe" touched "Scheduling Agent Service Class" (Path: "HKCU\WOW6432NODE\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\TREATAS") "Crisp.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER")46:T5c6,Process "msiexec.exe" (UID: 00000000-00005860) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00005860) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "Hub_Bandwidth64.exe" (UID: 00000000-00004716) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\ABDw8hu", HOMEDRIVE="C:"" Process "Hub_Bandwidth64.exe" (UID: 00000000-00004716) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "Hub_Bandwidth64.exe" (UID: 00000000-00005692) was launched with new environment variables: "GQBSWGEWIQGOGVSMLNLVU="kwnultainrnx", PROCESSOR_ARCHITEW6432="AMD64"" Process "Hub_Bandwidth64.exe" (UID: 00000000-00005692) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "PFramework.exe" (UID: 00000000-00002188) was launched with new environment variables: "RCEURRCLFKQACKJDNSUZKJCH="%TEMP%\26C2F9.tmp", YOXBZOOESUEYZWDITM="%TEMP%\27E222C.tmp", MLKZZGBYRITPOFEQPUX="%ALLUSERSPROFILE%\executor\Hub_Bandwidth64.exe""47:T459,"Hub_Bandwidth64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Hub_Bandwidth64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Hub_Bandwidth64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "PFramework.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Crisp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Crisp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Crisp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")48:Tfa6,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002188-00000C2B-2931198159] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002188-00000C2B-2931242585] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002188-00000C2B-2931249262] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002188-00000C2B-2931267856] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002188-00000C2B-2931419508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002188-00000C2B-2931422156] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002188-00000C2B-2931425294] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002188-00000C2B-2931435701] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002188-00000C2B-2931549902] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002188-00000C2B-2931574084] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002188-00000C2B-2931582042] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002188-00000C2B-2932191570] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002188-00000C2B-2932193665] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002188-00000C2B-2932195694] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002188-00000C2B-2932257362] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002188-00000C2B-2932338184] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002188-00000C2B-2932741415] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00002188-00000C2B-2933890895] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00002188-00000C2B-2933895384] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll" [Source: 00000000-00002188-00000C2B-2938924259] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00002188-00000C2B-2938978732] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002188-00000C2B-2941400704] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002188-00000C2B-2941458775] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002188-00000C2B-2941461433] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002188-00000C2B-2941497517]49:T4cf,"Hub_Bandwidth64.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WsBurn.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "DBGHelp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PFramework.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Crisp.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "BugSplat.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NLEService.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WS_ImageProc.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WS_Log.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WSUtilities.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NLEResource.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ExceptionHandler.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NLETransitionMgr.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "COMSupport.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "DVDSetting.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4a:T20ab,"3b4ebf.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Bypath Author: Dribble Timberland Keywords: Installer Comments: This installer database contains the logic and data required to install Bypath. Template: Intel;1033 Revision Number: {99FBFD4C-A6FA-4791-93D5-1390AB230183} Create Time/Date: Thu Feb 5 13:31:28 2026 Last Saved Time/Date: Thu Feb 5 13:31:28 2026 Number of Pages: 500 Number of Words: 10 Name of Creating Application: WiX Toolset (4.0.0.0) Security: 2"- [targetUID: N/A] "Hub_Bandwidth64.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%LOCALAPPDATA%\Exhilarator\Hub_Bandwidth64.exe]- [targetUID: 00000000-00004716] "WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\executor\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%ALLUSERSPROFILE%\executor\DBGHelp.dll]- [targetUID: 00000000-00004716] "PFramework.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\PFramework.exe]- [targetUID: 00000000-00005692] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\executor\Crisp.exe]- [targetUID: 00000000-00005692] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\DVDSetting.dll]- [targetUID: 00000000-00004716] "AssistFilter_amd64.job" has type "data"- Location: [%WINDIR%\Tasks\AssistFilter_amd64.job]- [targetUID: 00000000-00006268] "26C2F9.tmp" has type "data"- Location: [%TEMP%\26C2F9.tmp]- [targetUID: 00000000-00005692] "Steegcriedrak.eak" has type "data"- Location: [%ALLUSERSPROFILE%\executor\Steegcriedrak.eak]- [targetUID: 00000000-00004716] "ngen.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (337) with CRLF line terminators"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 73211 bytes 1 file at 0x2c last modified Sun Aug 26 2025 13:00:02 +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002188] "Drangkingais.dmox" has type "data"- Location: [%LOCALAPPDATA%\Exhilarator\Drangkingais.dmox]- [targetUID: 00000000-00004716] "inprogressinstallinfo.ipi" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "SourceHash_32096955-D76D-4EDB-933C-5515A8D40562_" has type "Unknown"- [targetUID: N/A] "3b4ebe.rbs" has type "data"- [targetUID: N/A] "MSI4F88.tmp" has type "data"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002188] "SlideShowEditor.ini" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Exhilarator\SlideShowEditor.ini]- [targetUID: 00000000-00004716] "27E222C.tmp" has type "data"- Location: [%TEMP%\27E222C.tmp]- [targetUID: 00000000-00005692] "3b4ebd.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Bypath Author: Dribble Timberland Keywords: Installer Comments: This installer database contains the logic and data required to install Bypath. Template: Intel;1033 Revision Number: {99FBFD4C-A6FA-4791-93D5-1390AB230183} Create Time/Date: Thu Feb 5 13:31:28 2026 Last Saved Time/Date: Thu Feb 5 13:31:28 2026 Number of Pages: 500 Number of Words: 10 Name of Creating Application: WiX Toolset (4.0.0.0) Security: 2"- [targetUID: N/A] "Hub_Bandwidth64.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\executor\Hub_Bandwidth64.exe]- [targetUID: 00000000-00004716] "WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DBGHelp.dll]- [targetUID: 00000000-00004716] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DVDSetting.dll]- [targetUID: 00000000-00004716] "Steegcriedrak.eak" has type "data"- Location: [%LOCALAPPDATA%\Exhilarator\Steegcriedrak.eak]- [targetUID: 00000000-00004716] "Drangkingais.dmox" has type "data"- Location: [%ALLUSERSPROFILE%\executor\Drangkingais.dmox]- [targetUID: 00000000-00004716] "SlideShowEditor.ini" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\executor\SlideShowEditor.ini]- [targetUID: 00000000-00004716]4b:T58e,"Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")4c:T10ea,"WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\executor\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%ALLUSERSPROFILE%\executor\DBGHelp.dll]- [targetUID: 00000000-00004716] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\DVDSetting.dll]- [targetUID: 00000000-00004716] "WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DBGHelp.dll]- [targetUID: 00000000-00004716] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DVDSetting.dll]- [targetUID: 00000000-00004716]4d:Ta88,"Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "HUB_BANDWIDTH64.EXE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")4e:T403,"Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\drangkingais.dmox" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\steegcriedrak.eak" "Hub_Bandwidth64.exe" reads file "c:\windows\syswow64\ntdll.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\bugsplat.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\comsupport.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\dbghelp.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\dvdsetting.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\exceptionhandler.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\hub_bandwidth64.exe" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\nleresource.dll" "Hub_Bandwidth64.exe" reads file "c:\users\%osuser%\appdata\local\exhilarator\nleservice.dll"4f:T9e2,"Hub_Bandwidth64.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\MSIMG32.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\VERSION.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\WSOCK32.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\WINMM.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\D3D9.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\WINHTTP.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\WINMMBASE.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\DWMAPI.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\WININET.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\URLMON.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\IERTUTIL.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\EVR.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\RTWORKQ.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\BCRYPT.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\INPUT.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\USERENV.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\XMLLITE.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\MSIMG32.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\VERSION.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\WSOCK32.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\WINMM.DLL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\WINHTTP.DLL"50:T681,"Hub_Bandwidth64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Exhilarator\HUB_BANDWIDTH64.EXE.LOCAL" "Hub_Bandwidth64.exe" trying to access non-existent file "C:\ProgramData\executor\HUB_BANDWIDTH64.EXE.LOCAL" "PFramework.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "PFramework.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\PFRAMEWORK.EXE.CONFIG" "PFramework.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "PFramework.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PFRAMEWORK.EXE.LOG" "PFramework.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "PFramework.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ZCASH" "PFramework.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "PFramework.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "PFramework.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "PFramework.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "PFramework.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\PFRAMEWORK.EXE.LOCAL" "Crisp.exe" trying to access non-existent file "C:\Windows\Tasks\ASSISTFILTER_AMD64.JOB"51:T5db,"Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\nleservice.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\ws_log.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\wsutilities.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\comsupport.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\nleresource.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\dvdsetting.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\ws_imageproc.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\wsburn.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\nletransitionmgr.dll" "Hub_Bandwidth64.exe" writes file "c:\users\%osuser%\appdata\local\exhilarator\bugsplat.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\bugsplat.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\comsupport.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\dbghelp.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\drangkingais.dmox" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\dvdsetting.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\exceptionhandler.dll" "Hub_Bandwidth64.exe" writes file "c:\programdata\executor\hub_bandwidth64.exe"52:T4d2,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002188-00000C2C-2941501044") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002188-00000C2C-2946175944") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSARecvMsg" (Indicator: "WSARecv"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSASendMsg" (Indicator: "WSASend"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp")53:T3b02,Found string "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.rsrc@.reloct%Whub_^[]YQPPh_^[]WWRVGY;~Nx&WVWSQR3ZY[_^t#SVW_^[]SVW3SVVS0@_^[]QSVW>h8xPWSVHt.uIVCtxjnt2Htj X;@_^[jD_WjWSPPPPPPt$WhPAQhPPh<{PhH{PhT{Ph\{Phd{@PShjD^VSVWSSSSSSShh|Shp|Sht|w.=%tMVWt>VWSPQRhPSh0ztah@zPj@jtfSh\zt9hQ^Ph0yVhHyVVSPSVVPQPVVPSPVVPWPVVSPSVVPQPVVPSPVVPWPPPVWVY_^[]PPVWVY_^[]PPVWVY_^[]PPVWVY_^[]PPVWVY_^[]PPVWVY_^[]PPVWVY_^[]PSPWSVWPQSSPY_^[~d;NGY;~_^[]5VW3y(97uQQQQQQQPQQQ9w4u8'uP8'uH}u%H>%u;VtZ93tPQQQ9>t.ht-h(~t_^]@_^]j`SPSVWPPPWV?{uAWY_^[?=u/Wt'9^SPtA~(_^t%Whk9~$~G;~$|~4_^@_^[];F0uQQSVW9_0~+G,;w0|8csm8csmPPPPj0N[u_^[]YYh8soF foF foF foV fo^0fof@fonPfov`fo~pfFGIuFGIu SW3 VWjY__^[Y__^[QQSVWd8_^]3=@P8csmt6h@P_^[t SVWr>PSPPPPPVVVVVVVVVVoF foF foF foV fo^0fof@fonPfov`fo~pfFGIuFGIuPh@P@uqW^TYY^_[]u9h0t-N_^[tPWj?[_^]8csmj0hpPRSW>csm8csm>csm>csm>csm?MOC?RCC|c;F@u(ju QjQQSV_^[]>csmHu4jYYPW8csm>MOC>RCC>csm>csm@_[^>csm8RCC8MOC8csmft!9qrY9qr.9z@_^[]@_^]URPQQhL$,3UVWS[_^]SVWjRhV?_^[]t&:aGPQt1SVPPPPPPGPSPh@PPPPPP"u3tA9M< t8SPj?SPj@SjPjASPjBSPjCSPj(SPj)SPj SPj1SPj2SPj3SPj4SPj5SPj6SPj7SPj*SPj+SPj SPj-SPj.SPj/SPj0SPjDSPjESPjFSPjGSPjHSPjISPjJSPjKSPjLSPjMSPjNSPjOSjPj8SPj9SPj:SPj;SPjSPj?SPj@SPjASPjBSPjCSPj(SPj)SPj S^_[3VVhU@ucP8$u t&HHt9$uXd}O;Sj*jSj*j0t-N_^[tPWj?[_^]j@uj@uQVWSjvN+D$SVWUj]_^[;t$ v-UQPXY]Y[tK<_t<<$t8<t0<-t t8WtB9MtY9}[_^]w @9t0t-HHtCt?jw&t <$u Wt$j t2j 8$u Wt4j QPhxsPhxsu#8H<0|L<9tEV<@un<_ua8?u'@w$ACu/f9F3=@PPWPtGWVhWVjU@PVWSSSSS@PSjUPPPPPVWw$_^[]SSSSSFlWP0Nu0NuQQQQQj;Yf9j;Yf9PPPPPVVVVVj@X]j@X]Pj@Qj@X]@PSV[_^]PPPPPWVU3vN+D$j@j /f;qr)f;q8f;Ar2f;ASVWjA_jZ+uBjAYjZ+t:f;u(9uWVSjVSjVVVVVt.SP[_^]PPPPP<8=uj"X_^[]PPPPPSSSSSPRQh~18]~E8]~';_t|%3wtVj;_tr.GWVjPVVVVQSVW3u.B;j X+u9Cf91ru!F3u9A9E$u+t"HHt9] t"HAO8u9Yj Y+j ^+_^[]f;1u_^[]PPPPPu!CWWWWWPPPPPtQh$t@h,jPjYVu&9EYY_;QSVWYu2Vj@hj@Whtnj@tMj_SPPPPPuF9Cu4Wju4Wjt9WjtLh$t;h,WHPhHtgf9SHPhtVjUj@Sht0j@Ht+Ht$HtHuzju0hPu!hXu9Y<5|ESSSSS_^[]XSVWQSVWj@%@j@%@VVVVVtWhhtHHt*Ht#uJSSRD2$$SSSSS@A;EbWWWWjPRPQhj-Xfj-Xf_[^]SVjA[jZ^+jAZjZ^ItDft?f;tt9MHt#jt3f;XP_fZf9WHtRjXf9EXf9ED1$$D1$$_^[ut\j=Sun9}t&9=?snjtPSSPPPPP_[^]<=t VPRQPRPQh~"VPt7QVWjxYf;jXYf;jxYf;jXYf;uHjAXf;Zv&jjxYf;jXYf;jxYf;jXYf;uWjAXf;Zv2jWPPPPjPPWVjY^_[PPPPPj0Yf;Qvf;Qvf;Qvf;Qvf;Qvf;Qvf;Qvf;_^[tPVVVVQ9E$u-t*j0X;j0Xf;j0Xf;r%f;MjYf;+t"HHtj0Xf;HHu"%f;Mj0Xf;u9YwM9q_^[]Crash Report creation failed with error 0x%lx: %sErrorDBGHELP.DLLMiniDumpWriteDumpC:\temp\.dmpFull Memory Dump CreatedHTTP/1.0Accept: */*Content-Type: application/x-www-form-urlencodedPOSTContent-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY--MULTI-PARTS-FORM-DATA-BOUNDARYContent-Length: %dContent-Type: text/xml--%sContent-Disposition: form-data; name="%s"--%sContent-Disposition: form-data; name="%s"; filename="%s"Content-Type: %sContent Typeapplication/octet-streamhttphttpsvector too longkernel32.dllFloating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.TotalUptimeCrashCount%Y-%m-%d %H:%M:%SBugSplat.dll: %s %sBugSplat.dll: %sbugsplat.logBugSplat.dll: BugSplat.dll: Software\BugSplatSoftware\BugSplat\%s\%s\%sDebugFredFredsAppWaitCreateReportWaitSendReportSetUnhandledExceptionFilterBugSplatRc.dllBugSplatRC resource DLL not foundNot foundhttp://www.bugsplatsoftware.com/files/dbghelp.dllBsSndRpt.exeBsSndRpt.ini/i "VendorBugSplatApplicationVersionMiniDumpDescriptionUserLogPathUserEmailUserZipPath"%s"DotNetAdditionalFile%d /dl /dc"%s" %s%d.%d.%d.%dwww.bugsplatsoftware.com/ws/UpgradeTests.phpMERONG(0.9/;p)true%s!%08lxBugSplatHD.exe /p %ld /c "%s" /a "%s" /v "%s" /d "FComponent CategoriesFileTypeInterfaceHardwareMimeSECURITYSYSTEMSoftwareTypeLibCLSIDAppIDForceRemoveNoRemoveDeleteAdvapi32.dllRegOpenKeyTransactedARegCreateKeyTransactedARegDeleteKeyTransactedARegDeleteKeyExAHKCRHKCUHKLMHKPDHKDDHKCCHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_DYN_DATAHKEY_CURRENT_CONFIG=sRP F i3%@Qm6t>;)\}@{'=CPf/2qVDEST[?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~('8PW700PP`h`hhhxppwpp__based(__cdecl__pascal__stdcall__thiscall__fastcall__vectorcall__clrcall__eabi__ptr64__restrict__unalignedrestrict( new deleteoperator`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard' Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'CV: template-parameter-generic-type-`anonymous namespace'`non-type-template-parametervoid`template-parameterNULL`vtordispex{`vtordisp{`adjustor{`local static destructor helper'`template static data member constructor helper'`template static data member destructor helper'static virtual private: protected: public: [thunk]:extern "C" char short int long unsigned void volatilestd::nullptr_t,..., throw(charshortlongfloatdoublebool__int8__int16__int32__int64__int128wchar_t__w64 UNKNOWNsigned const volatile`unknown ecsu'union struct class coclass cointerface enum volatile const cli::array?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~1#SNAN1#IND1#INF1#QNANCreateFile2alnumalphablankcntrldigitgraphlowerprintpunctspaceupperxdigitbad function callgenericunknown erroriostreamiostream stream errorsystemregex_error(error_collate): The expression contained an invalid collating element name.regex_error(error_ctype): The expression contained an invalid character class name.regex_error(error_escape): The expression contained an invalid escaped character or a trailing escape.regex_error(error_backref): The expression contained an invalid back reference.regex_error(error_brack): The expression contained mismatched [ and ].regex_error(error_paren): The expression contained mismatched ( and ).regex_error(error_brace): The expression contained mismatched { and }.regex_error(error_badbrace): The expression contained an invalid range in a { expression }.regex_error(error_range): The expression contained an invalid character range such as [b-a] in most encodings.regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine.regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression.regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level.regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified character sequence.regex_error(error_parse)regex_error(error_syntax)regex_errorstring too longinvalid string positionaddress not availablealready connectedargument list too longargument out of domainbad addressbad file descriptorbad messagebroken pipeconnection abortedconnection already in progressconnection refusedconnection resetdestination address requiredexecutable format errorfile too largehost unreachableidentifier removedillegal byte sequenceinappropriate io control operationinvalid seekis a directorymessage sizenetwork downnetwork resetnetwork unreachableno buffer spaceno child processno linkno message availableno messageno protocol optionno stream resourcesno such device or addressno such processnot a directorynot a socketnot a streamnot connectednot supportedoperation in progressoperation not permittedoperation not supportedoperation would blockowner deadprotocol errorprotocol not supportedread only file systemresource deadlock would occurresult out of rangestate not recoverablestream timeouttext file busytimed outtoo many files open in systemtoo many linkstoo many symbolic link levelsvalue too largewrong protocol typepermission deniedfile existsno such devicefilename too longdevice or resource busyio errordirectory not emptyinvalid argumentno space on deviceno such file or directoryfunction not supportedno lock availablenot enough memoryresource unavailable try againcross device linkoperation canceledtoo many files openpermission_deniedaddress_in_useaddress_not_availableaddress_family_not_supportedconnection_already_in_progressbad_file_descriptorconnection_abortedconnection_refusedconnection_resetdestination_address_requiredbad_addresshost_unreachableoperation_in_progressinterruptedinvalid_argumentalready_connectedtoo_many_files_openmessage_sizefilename_too_longnetwork_downnetwork_resetnetwork_unreachableno_buffer_spaceno_protocol_optionnot_connectednot_a_socketoperation_not_supportedprotocol_not_supportedwrong_protocol_typetimed_outoperation_would_blockaddress family not supportedaddress in useRSDSC:\www\src\BugSplat\bin\BugSplat.pdbBugSplat.dll??0BugSplatImp@@QAE@XZ??0MiniDmpSender@@QAE@ABV0@@Z??0MiniDmpSender@@QAE@PBD000K@Z??0MiniDmpSender@@QAE@PBG000K@Z??0MiniDmpSender@@QAE@PB_W000K@Z??1MiniDmpSender@@UAE@XZ??4BugSplatImp@@QAEAAV0@ABV0@@Z??4MiniDmpSender@@QAEAAV0@ABV0@@Z??_7MiniDmpSender@@6B@?CreateMiniDump@BugSplatImp@@QAEHPAUHINSTANCE__@@KPAXKPAU_EXCEPTION_POINTERS@@PBDPADK@Z?DoFullMemoryDumpThenExit@BugSplatImp@@2_NA?GetReducedGuid@BugSplatImp@@QAEXPADK@Z?MiniDumpType@BugSplatImp@@2W4_MINIDUMP_TYPE@@A?ReduceGuidString@BugSplatImp@@QAEXPADK@Z?ResumeSuspendedThreads@BugSplatImp@@QAEXXZ?SetDbghelpFlags@MiniDmpSender@@QAEXW4dbghelpFlags@1@@Z?SuspendAllThreadsInProcess@BugSplatImp@@QAEXPAX@Z?SuspendThreadsInCurrentProcess@BugSplatImp@@QAEXXZ?createReport@MiniDmpSender@@QAEXPAU_EXCEPTION_POINTERS@@@Z?createReport@MiniDmpSender@@QAEXPBD@Z?createReport@MiniDmpSender@@QAEXPB_W@Z?createReport@MiniDmpSender@@QAEXXZ?createReportAndExit@MiniDmpSender@@QAEXXZ?enableExceptionFilter@MiniDmpSender@@QAE_N_N@Z?enableFullMemoryDumpAndExit@MiniDmpSender@@QAE_N_N@Z?getFlags@MiniDmpSender@@QBEKXZ?imp@MiniDmpSender@@QAEPAXXZ?isExceptionFilterEnabled@MiniDmpSender@@QBE_NXZ?isFullMemoryDumpAndExitEnabled@MiniDmpSender@@QBE_NXZ?resetAppIdentifier@MiniDmpSender@@QAEXPBD@Z?resetAppIdentifier@MiniDmpSender@@QAEXPB_W@Z?resetVersionString@MiniDmpSender@@QAEXPBD@Z?resetVersionString@MiniDmpSender@@QAEXPB_W@Z?setCallback@MiniDmpSender@@QAEXP6A_NIPAX0@Z@Z?setDefaultUserEmail@MiniDmpSender@@QAEXPBD@Z?setDefaultUserEmail@MiniDmpSender@@QAEXPBG@Z?setDefaultUserEmail@MiniDmpSender@@QAEXPB_W@Z?setDefaultUserName@MiniDmpSender@@QAEXPBD@Z?setDefaultUserName@MiniDmpSender@@QAEXPBG@Z?setDefaultUserName@MiniDmpSender@@QAEXPB_W@Z?setFlags@MiniDmpSender@@QAE_NK@Z?setUserZipPath@MiniDmpSender@@QAEXPBD@Z?setUserZipPath@MiniDmpSender@@QAEXPBG@Z?setUserZipPath@MiniDmpSender@@QAEXPB_W@Z?storeUserLog@MiniDmpSender@@QAEXPBD@Z?storeUserLog@MiniDmpSender@@QAEXPB_W@Z?unhandledExceptionHandler@MiniDmpSender@@QAEJPAU_EXCEPTION_POINTERS@@@ZCreateMiniDmpSenderDestroyMiniDmpSenderMDSGetFlagsMDSResetAppIdentifierMDSResetVersionStringMDSSetFlagsInternetOpenAInternetCloseHandleInternetConnectAInternetReadFileInternetWriteFileHttpOpenRequestAHttpAddRequestHeadersAHttpSendRequestAHttpSendRequestExAHttpEndRequestAHttpQueryInfoAInternetAttemptConnectWININET.dllPathFileExistsAPathAppendAPathRemoveExtensionAPathStripPathASHLWAPI.dllInterlockedIncrementInterlockedDecrementGetProcAddressLocalFree"; File: "BugSplat.dll"), Found string "Content-Disposition: form-data;"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp")54:T1638,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002188-00000C2C-2941501044") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "gethostname" (Indicator: "gethostname"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found reference to API "An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed." (Indicator: " connect "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The computer WAS able to connect on a secondary transport." (Indicator: " connect "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The operating system will currently accept only 16-bit (R2) pc-cards on this controller." (Indicator: " accept "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "A port with the 'do not disturb' flag set attempted to send a message to a port in a suspended process." (Indicator: " send "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Attempt to send a message to a disconnected communication port." (Indicator: " send "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "An access to a user buffer failed at an "expected" point in time. This code is defined since the caller does not want to accept STATUS_ACCESS_VIOLATION in its filter." (Indicator: " accept "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The system bios failed to connect a system interrupt to the device or bus for which the device is connected." (Indicator: " connect "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The server received the messages but did not send a reply." (Indicator: " send "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product." (Indicator: " shutdown "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Please click OK to shutdown the system. You can use the recovery console to diagnose the system further." (Indicator: " shutdown "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "The client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply." (Indicator: " send "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "A system shutdown is in progress." (Indicator: " shutdown "; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")55:T163d,Heuristic match: "qdxmx_.mm" Heuristic match: "#'.tj" Heuristic match: "y9.bf" Heuristic match: "3'y.gb" Heuristic match: "lf.pk" Pattern match: "v.ps/s2" Heuristic match: "v8+ spu.sn" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Heuristic match: "testmycdn.azureedge.net" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=dh" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=dp" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=do" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=db" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=ds" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=dc" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=r" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=c3" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=c4" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=c2" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=c5" Pattern match: "http://cbs.wondershare.com/go.php?pid=619&m=c6" Pattern match: "http://www.google-analytics.com/collect" Pattern match: "cbs.wondershare.com/go.php?pid=619&m=dh" Pattern match: "cbs.wondershare.com/go.php?pid=619&m=do" Pattern match: "cbs.wondershare.com/go.php?pid=619&m=ds" Pattern match: "cbs.wondershare.com/go.php?pid=619&m=r" Pattern match: "re.com/go.php?pid=619&m=c3" Pattern match: "http://www.w3.org/2001/xmlschema" Heuristic match: "& .hk" Heuristic match: "b<.mm" Heuristic match: "wgw.ck" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "dowsupdate.com" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "ntrust.net" Heuristic match: "tt@.tt" Heuristic match: "vp.mv" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "swvh.vg" Heuristic match: "^g.vi" Pattern match: "http://go.microsoft.com/fwlink/?linkid=228610" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851152" Pattern match: "https://go.microsoft.com/fwlink/?linkid=852747" Heuristic match: "f9.tm"56:T56d1,Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvf8;+ggreater" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcjw02do402'q>" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pkwashington1redmond1microsoft" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcwashington1redmond1microsoft" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc1.3.132.0.33ecdp1.3.132.0.35@eckp" - Source: "00000000-00002188.00000001.254465.087B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002188.00000001.254465.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000001.254465.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000001.254465.09584000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002188.00000001.254465.09584000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcud*gnmx" - Source: "00000000-00002188.00000001.254465.09584000.00000004.mdmp") Found URL "https://http://sftp://ftp://www.etc.e.g.i.e.__amp__kernel32.dllunknown" - Source: "00000000-00002188.00000002.256383.00E80000.00000002.mdmp") Found URL "https://www.jpchacha.com/chasysdraw/webapi/feedback.php?ver=5.34.01&rel=%s&lang=%s&event=%s\vfs\/vfs//windowsapps/5.34.01error:" - Source: "00000000-00002188.00000002.256383.00E80000.00000002.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvf8;+ggreater" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcjw02do402'q>" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pkwashington1redmond1microsoft" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcwashington1redmond1microsoft" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc1.3.132.0.33ecdp1.3.132.0.35@eckp" - Source: "00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002188.00000002.256383.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000002.256383.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002188.00000002.256383.09584000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002188.00000002.256383.09584000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcud*gnmx" - Source: "00000000-00002188.00000002.256383.09584000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002188.00000002.256383.73291000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000000.250550.029E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000001.252470.029E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000001.252470.10037000.00000002.mdmp") Found URL "http://www.starburnsoftware.com/products/starburn-sdk/buy" - Source: "00000000-00005692.00000001.252470.72B36000.00000002.mdmp") Found URL "http://www.starburnsoftware.com/products/starburn-sdk/buyhttp://www.starburnsoftware.com/products/starburn-sdk/keyrequestabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/b" - Source: "00000000-00005692.00000001.252470.72B36000.00000002.mdmp") Found URL "http://www.mp3dev.org/experimental" - Source: "00000000-00005692.00000001.252470.72B36000.00000002.mdmp") Found URL "http://cbs.wondershare.com/go.php?pid=619&m=dhhttp://cbs.wondershare.com/go.php?pid=619&m=dphttp://cbs.wondershare.com/go.php?pid=619&m=dohttp://cbs.wondershare.com/go.php?pid=619&m=dbhttp://cbs.wondershare.com/go.php?pid=619&m=dshttp://cbs.wondershare.com/go.php?pid=619&m=dchttp://cbs.wondershare.com/go.php?pid=619&m=rmenupagehttp://cbs.wondershare.com/go.php?pid=619&m=c3surveypagehttp://cbs.wondershare.com/go.php?pid=619&m=c4http://cbs.wondershare.com/go.php?pid=619&m=c2http://cbs.wondershare.com/go.php?pid=619&m=c5http://cbs.wondershare.com/go.php?pid=619&m=c6openiexploreapartmentfreebothneutral%s," - Source: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschemachoicesequencecomplexcontentsimplecontentextensionrestrictionchoicesequencequalifiedunqualifiedfalsetrueiso-8859-1us-asciiutf-16ucs-2unicodeutf-16ucs-2unicodekernel32.dllcreatetoolhelp32snapshotheap32listfirstheap32listnextheap32firstheap32nexttoolhelp32readprocessmemoryprocess32firstprocess32nextprocess32firstwprocess32nextwthread32firstthread32nextmodule32firstmodule32nextmodule32firstwmodule32nextw>>>>>>>>>>processname:>>>>>>win32majorversion" - Source: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found URL "http://support.wondershare.com/index.php?submod=ticket&method=onlineforminactivefontcolorclbluetfslabellbltitleleftwidthheightautosizecaptionisorry," - Source: "00000000-00005692.00000002.253295.0060D000.00000002.mdmp") Found URL "http://support.wondershare.comparentshowhintshowhinttransparent" - Source: "00000000-00005692.00000002.253295.0060D000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005692.00000002.253295.029E0000.00000004.mdmp") Found URL "http://ocsp.digicert." - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "https://sectigo.com/cps2crl." - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "http://www.szip.or4g/i" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "http://c0rl.mea" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "http://crl.comod" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "http://crl.c(0&0b$=l9slf" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "http://crl.sectigo.com/sliccodesigningro@otr46.+" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp") Found URL "https://sectigo.com/cps0crl.publictimestampingcarh36.n0l0etg40ocspr5\e2ka" - Source: "00000000-00005692.00000002.253295.0A43F000.00000004.mdmp")57:Tad1,Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")58:T7fd,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")59:T9df,Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp"5a:Ta2f,"PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Chromium\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google(x86)\Chrome\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Edge\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\MapleStudio\ChromePlus\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Iridium\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\7Star\7Star\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\CentBrowser\User Data\* (UID: 00000000-00002188) "PFramework.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002188) "PFramework.exe" called "FindNextFileW" with parameter AutofillStates (UID: 00000000-00002188) "PFramework.exe" called "FindNextFileW" with parameter BrowserMetrics (UID: 00000000-00002188) "PFramework.exe" called "FindNextFileW" with parameter CertificateRevocation (UID: 00000000-00002188)5b:T1b63,file/memory contains long string with (Indicator: "aes"; File: "Drangkingais.dmox") Found string "John Paul Chacha's Lab" (Indicator: "chacha"; Source: "00000000-00002188.00000001.254465.00E90000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp") Found string "John Paul Chacha, 2001-2025" (Indicator: "chacha"; Source: "00000000-00002188.00000001.254465.00E90000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp") Found string "John Paul Chacha's Chasys Draw IES" (Indicator: "chacha"; Source: "00000000-00002188.00000001.254465.00E90000.00000002.mdmp") Found string "name="JohnPaulChacha.ChasysDrawIES.Lobby"" (Indicator: "chacha"; Source: "00000000-00002188.00000001.254465.00E90000.00000002.mdmp") Found string "3DES_112" (Indicator: "3des"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000001.254465.087B0000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.087B0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found string "aES8dKiZeJ" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp") Found string "aeS;" (Indicator: "aes"; Source: "00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp") Found string "The Diffie-Hellman group is not compatible with the policy type." (Indicator: "diffie-hellman"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")5c:T12e7,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")5d:T540,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")5e:T7ad,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00005692.00000002.253295.00401000.00000020.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")5f:Tb5e,Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")60:T1acd,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")61:T66c,file/memory contains long string with (Indicator: "OpenProcess"; File: "ExceptionHandler.dll") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002188-00000C2C-2931207938") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00002188-00000C2C-2941480150") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002188-00000C2C-2941683207") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00002188-00000C2C-2941683229") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found string "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")62:T1ee7,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddResourceAttributeAce" (Indicator: "AddResourceAttributeAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAddScopedPolicyIDAce" (Indicator: "AddScopedPolicyIDAce"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")63:T619,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00006268.00000000.253296.00A31000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")64:Tb44,"Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\EXECUTOR\HUB_BANDWIDTH64.EXE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\PFRAMEWORK.EXE"; Value: "") "Hub_Bandwidth64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\EXECUTOR\CRISP.EXE"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "PFramework.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "")65:T65e,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp")66:T9f7,Dropped file: "Hub_Bandwidth64.exe" - Location: [%LOCALAPPDATA%\Exhilarator\Hub_Bandwidth64.exe]- [targetUID: 00000000-00004716] Dropped file: "PFramework.exe" - Location: [%LOCALAPPDATA%\PFramework.exe]- [targetUID: 00000000-00005692] Dropped file: "Crisp.exe" - Location: [%APPDATA%\executor\Crisp.exe]- [targetUID: 00000000-00005692] Dropped file: "WS_ImageProc.dll" - Location: [%LOCALAPPDATA%\Exhilarator\WS_ImageProc.dll]- [targetUID: 00000000-00004716] Dropped file: "WSUtilities.dll" - Location: [%LOCALAPPDATA%\Exhilarator\WSUtilities.dll]- [targetUID: 00000000-00004716] Dropped file: "ExceptionHandler.dll" - Location: [%LOCALAPPDATA%\Exhilarator\ExceptionHandler.dll]- [targetUID: 00000000-00004716] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002188] Dropped file: "Drangkingais.dmox" - Location: [%LOCALAPPDATA%\Exhilarator\Drangkingais.dmox]- [targetUID: 00000000-00004716] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002188] Dropped file: "SlideShowEditor.ini" - Location: [%LOCALAPPDATA%\Exhilarator\SlideShowEditor.ini]- [targetUID: 00000000-00004716] Dropped file: "WsBurn.dll" - Location: [%LOCALAPPDATA%\Exhilarator\WsBurn.dll]- [targetUID: 00000000-00004716] Dropped file: "DBGHelp.dll" - Location: [%LOCALAPPDATA%\Exhilarator\DBGHelp.dll]- [targetUID: 00000000-00004716] Dropped file: "BugSplat.dll" - Location: [%LOCALAPPDATA%\Exhilarator\BugSplat.dll]- [targetUID: 00000000-00004716] Dropped file: "NLEService.dll" - Location: [%LOCALAPPDATA%\Exhilarator\NLEService.dll]- [targetUID: 00000000-00004716] Dropped file: "WS_Log.dll" - Location: [%LOCALAPPDATA%\Exhilarator\WS_Log.dll]- [targetUID: 00000000-00004716] Dropped file: "NLEResource.dll" - Location: [%LOCALAPPDATA%\Exhilarator\NLEResource.dll]- [targetUID: 00000000-00004716] Dropped file: "NLETransitionMgr.dll" - Location: [%LOCALAPPDATA%\Exhilarator\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] Dropped file: "COMSupport.dll" - Location: [%LOCALAPPDATA%\Exhilarator\COMSupport.dll]- [targetUID: 00000000-00004716] Dropped file: "DVDSetting.dll" - Location: [%LOCALAPPDATA%\Exhilarator\DVDSetting.dll]- [targetUID: 00000000-00004716] Dropped file: "Steegcriedrak.eak" - Location: [%LOCALAPPDATA%\Exhilarator\Steegcriedrak.eak]- [targetUID: 00000000-00004716]67:T13b0,"Hub_Bandwidth64.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%LOCALAPPDATA%\Exhilarator\Hub_Bandwidth64.exe]- [targetUID: 00000000-00004716] "WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\executor\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%ALLUSERSPROFILE%\executor\DBGHelp.dll]- [targetUID: 00000000-00004716] "PFramework.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\PFramework.exe]- [targetUID: 00000000-00005692] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\executor\Crisp.exe]- [targetUID: 00000000-00005692] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\DVDSetting.dll]- [targetUID: 00000000-00004716] "Hub_Bandwidth64.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\executor\Hub_Bandwidth64.exe]- [targetUID: 00000000-00004716] "WsBurn.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WsBurn.dll]- [targetUID: 00000000-00004716] "DBGHelp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DBGHelp.dll]- [targetUID: 00000000-00004716] "BugSplat.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\BugSplat.dll]- [targetUID: 00000000-00004716] "NLEService.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEService.dll]- [targetUID: 00000000-00004716] "WS_ImageProc.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WS_ImageProc.dll]- [targetUID: 00000000-00004716] "WS_Log.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\WS_Log.dll]- [targetUID: 00000000-00004716] "WSUtilities.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\WSUtilities.dll]- [targetUID: 00000000-00004716] "NLEResource.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLEResource.dll]- [targetUID: 00000000-00004716] "ExceptionHandler.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\executor\ExceptionHandler.dll]- [targetUID: 00000000-00004716] "NLETransitionMgr.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\NLETransitionMgr.dll]- [targetUID: 00000000-00004716] "COMSupport.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\COMSupport.dll]- [targetUID: 00000000-00004716] "DVDSetting.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Exhilarator\DVDSetting.dll]- [targetUID: 00000000-00004716]68:T7a3,"Hub_Bandwidth64.exe" wrote 60928 bytes starting with PE header signature to file "C:\ProgramData\executor\COMSupport.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hub_Bandwidth64.exe" wrote 42496 bytes starting with PE header signature to file "C:\ProgramData\executor\DVDSetting.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hub_Bandwidth64.exe" wrote 61952 bytes starting with PE header signature to file "C:\ProgramData\executor\NLETransitionMgr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hub_Bandwidth64.exe" wrote 14544 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\executor\Crisp.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Hub_Bandwidth64.exe" wrote 8304 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\PFramework.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...69:T4c6,Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_DiskDrive" (Indicator: "root\cimv2"; in Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_PhysicalMemory.Tag="Physical Memory 0"" (Indicator: "root\cimv2"; in Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE0"" (Indicator: "root\cimv2"; in Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000001.254465.087B0000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.087B0000.00000004.mdmp")6a:T9f8,"PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "PFramework.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")6b:T6ee,File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\executor\WsBurn.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections" was dropped at "%ALLUSERSPROFILE%\executor\DBGHelp.dll" File type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\BugSplat.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\NLEService.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\WS_Log.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\NLEResource.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\NLETransitionMgr.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\COMSupport.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\DVDSetting.dll" File type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections" was dropped at "%ALLUSERSPROFILE%\executor\Hub_Bandwidth64.exe" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\WS_ImageProc.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\WSUtilities.dll" File type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections" was dropped at "%ALLUSERSPROFILE%\executor\ExceptionHandler.dll"6c:T11e1,"PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "PFramework.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\CHROMIUM\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\IRIDIUM\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\7STAR\7STAR\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\CENTBROWSER\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\CHEDOT\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\VIVALDI\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\KOMETA\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\ELEMENTS BROWSER\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\EPIC PRIVACY BROWSER\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\UCOZMEDIA\URAN\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\CATALINAGROUP\CITRIO\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\COOWON\COOWON\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\LIEBAO\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\QIP SURF\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\ORBITUM\USER DATA" "PFramework.exe" trying to open a file "%LOCALAPPDATA%\COMODO\DRAGON\USER DATA"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791422911651,"unified_at":"2026-10-08T01:28:31.651Z","metadata":{"hashes":{"sha256":"3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","sha1":"c88859ff597fc67dde5b35bfd24ac7fc75d1afe4","md5":"7714b76087e4e15dc88060d277e32132","sha512":"f595319dd4b3c4693e88811b27e2d6ff0d85bc7335e34eaa8ec8490b973223e5e474158407df9ad34c6561c8481d9a08cf83b5518b4f3e03ff40b3933ecc64c9","ssdeep":"98304:BuTMX6w9mHJbA8+v6l+C58YEHs12VRV/EIULRampKGR1:SMKw9mpPljeYEM1GRVXULa01","ssdeep_chunks":["98304:BuTMX6w","98304:uTMX6w9","98304:TMX6w9m","98304:MX6w9mH","98304:X6w9mHJ","98304:6w9mHJb","98304:w9mHJbA","98304:9mHJbA8","98304:mHJbA8+","98304:HJbA8+v","98304:JbA8+v6","98304:bA8+v6l","98304:A8+v6l+","98304:8+v6l+C","98304:+v6l+C5","98304:v6l+C58","98304:6l+C58Y","98304:l+C58YE","98304:+C58YEH","98304:C58YEHs","98304:58YEHs1","98304:8YEHs12","98304:YEHs12V","98304:EHs12VR","98304:Hs12VRV","98304:s12VRV/","98304:12VRV/E","98304:2VRV/EI","98304:VRV/EIU","98304:RV/EIUL","98304:V/EIULR","98304:/EIULRa","98304:EIULRam","98304:IULRamp","98304:ULRampK","98304:LRampKG","98304:RampKGR","98304:ampKGR1","196608:BuTMX6w","196608:uTMX6w9","196608:TMX6w9m","196608:MX6w9mH","196608:X6w9mHJ","196608:6w9mHJb","196608:w9mHJbA","196608:9mHJbA8","196608:mHJbA8+","196608:HJbA8+v","196608:JbA8+v6","196608:bA8+v6l","196608:A8+v6l+","196608:8+v6l+C","196608:+v6l+C5","196608:v6l+C58","196608:6l+C58Y","196608:l+C58YE","196608:+C58YEH","196608:C58YEHs","196608:58YEHs1","196608:8YEHs12","196608:YEHs12V","196608:EHs12VR","196608:Hs12VRV","196608:s12VRV/","196608:12VRV/E","196608:2VRV/EI","196608:VRV/EIU","196608:RV/EIUL","196608:V/EIULR","196608:/EIULRa","196608:EIULRam","196608:IULRamp","196608:ULRampK","196608:LRampKG","196608:RampKGR","196608:ampKGR1","98304:SMKw9mp","98304:MKw9mpP","98304:Kw9mpPl","98304:w9mpPlj","98304:9mpPlje","98304:mpPljeY","98304:pPljeYE","98304:PljeYEM","98304:ljeYEM1","98304:jeYEM1G","98304:eYEM1GR","98304:YEM1GRV","98304:EM1GRVX","98304:M1GRVXU","98304:1GRVXUL","98304:GRVXULa","98304:RVXULa0","98304:VXULa01"],"imphash":"Unknown"},"file_info":{"file_name":"TASCJBAO.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":4218880,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1770344641000,"last_seen":1770358953000,"last_multi_scan":1770358953000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":191,"suspicious_count":15,"malicious_count":8,"total":214},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Able to access mailslot-related API (String)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve the system language code"},{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"suspicious","value":"Contains ability to discover peripheral devices using WMI"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlComputeCrc32\" (Indicator: \"RtlComputeCrc32\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBufferEx\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtUnmapViewOfSectionEx\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSectionEx\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000001.254465.087B0000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.087B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"PFramework.exe\" queried SystemProcessInformation at 00000000-00002188-00000C15-2920543486 [PID: 2188]\n \"PFramework.exe\" queried SystemProcessInformation at 00000000-00002188-00000C15-2920551075 [PID: 2188]\n \"PFramework.exe\" queried SystemProcessInformation at 00000000-00002188-00000C15-2920725134 [PID: 2188]\n \"PFramework.exe\" queried SystemProcessInformation at 00000000-00002188-00000C15-2920732696 [PID: 2188]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00006268-00000C15-2931336789 [PID: 6268]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00006268-00000C15-2931344185 [PID: 6268]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00006268-00000C15-2931619467 [PID: 6268]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00006268-00000C15-2931627217 [PID: 6268]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ecx\n edx in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor esi\n edx in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor eax\n ecx in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor edx\n eax in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor eax\n esi in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor edi\n ecx in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor ecx\n eax in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor esi\n eax in Stream UID: 00000000-00002188-7094-273-00E6A0D0\n Assembly shows XOR instruction xor edx\n ecx in Stream UID: 00000000-00002188-7094-273-00E6A0D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp, 00000000-00002188.00000002.256383.088B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99732","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188-00000C2C-2941482725\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformationEx\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"BugSplat.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188-00000C2C-2941482725\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found string \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"3b4ebe.rbs\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"RtlGetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlpGetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"NtQueryDefaultUILanguage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"NtQueryInstallUILanguage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"WMRSendMessageString\" (Indicator: \"sendmessage\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"PFramework.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"PFramework.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002188)\n \"PFramework.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002188)\n \"PFramework.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"PFramework.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00002188)\n \"PFramework.exe\" called \"GetMonitorInfoA\" with parameters (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"PFramework.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"PFramework.exe\" called \"IsWow64Process\" with parameter \"2188\" - (UID: 00000000-00002188)\n \"Crisp.exe\" called \"IsWow64Process\" with parameter \"6268\" - (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"PFramework.exe\" called \"GetWindowTextW\" (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"PFramework.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"RtlGetSystemTimePrecise\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Hub_Bandwidth64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Hub_Bandwidth64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"PFramework.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Crisp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"RtlGetSystemTimePrecise\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQueryVolumeInformationFile\" (Indicator: \"ZwQueryVolumeInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 64791-150-004081F0","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"PFramework.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"\n \"PFramework.exe\" issued a query \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\"\n \"PFramework.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002188.00000001.254465.05B90000.00000004.mdmp\n 00000000-00002188.00000002.256383.05596000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Hub_Bandwidth64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PFramework.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"PFramework.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Crisp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CRISP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Hub_Bandwidth64.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"ZwCreateKey\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyTransacted\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyedEvent\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"NLEResource.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Crisp.exe\")\n file/memory contains long string(File: \"NLEService.dll\")\n file/memory contains long string(File: \"WS_ImageProc.dll\")\n file/memory contains long string(File: \"WS_Log.dll\")\n file/memory contains long string(File: \"WSUtilities.dll\")\n file/memory contains long string(File: \"NLEResource.dll\")\n file/memory contains long string(File: \"ExceptionHandler.dll\")\n file/memory contains long string(File: \"NLETransitionMgr.dll\")\n file/memory contains long string(File: \"COMSupport.dll\")\n file/memory contains long string(File: \"DVDSetting.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"PFramework.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002188.00000001.254465.050B0000.00000004.mdmp, 00000000-00002188.00000001.254465.08610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.133.74.65:56001\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"NtCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtCreateDirectoryObjectEx\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwCreateDirectoryObjectEx\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"mLoadModule\" (Indicator: \"LoadModule\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtOpenEventPair\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwOpenEvent\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventPair\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WsBurn.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Crisp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"NLEService.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"WSUtilities.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"NLEResource.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"ExceptionHandler.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"NLETransitionMgr.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"COMSupport.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"DVDSetting.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found string \"Mozilla/4.0 (compatible; MSIE 6.00)\" (Indicator: \"mozilla/4.0 (\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"PFramework.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FAF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"PFramework.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 732E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 61AF0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 612A0000\n \"Hub_Bandwidth64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75AD0000\n \"Hub_Bandwidth64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73710000\n \"PFramework.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75AD0000\n \"PFramework.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73710000\n \"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75AD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 34F00000\n \"PFramework.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72000000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 64380000\n \"Hub_Bandwidth64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77330000\n \"PFramework.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77330000\n \"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77330000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$45","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"testmycdn.azureedge.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$47","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005860)\n Spawned process \"Hub_Bandwidth64.exe\" (UID: 00000000-00004716)\n Spawned process \"Hub_Bandwidth64.exe\" (UID: 00000000-00005692)\n Spawned process \"PFramework.exe\" (UID: 00000000-00002188)\n Spawned process \"Crisp.exe\" (UID: 00000000-00006268)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005860)\n Spawned process \"Hub_Bandwidth64.exe\" (UID: 00000000-00004716)\n Spawned process \"Hub_Bandwidth64.exe\" (UID: 00000000-00005692)\n Spawned process \"PFramework.exe\" (UID: 00000000-00002188)\n Spawned process \"Crisp.exe\" (UID: 00000000-00006268)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$49","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Hub_Bandwidth64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\26C2F9.tmp\"\n \"Hub_Bandwidth64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\271B19.tmp\"\n \"Hub_Bandwidth64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\27E222C.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleEx\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleByMapping\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleByName\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"NtRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtQueueApcThreadEx\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThreadEx\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"26C2F9.tmp\" has type \"data\" - Location: [%TEMP%\\26C2F9.tmp]\n \"MSI4F88.tmp\" has type \"data\"\n \"27E222C.tmp\" has type \"data\" - Location: [%TEMP%\\27E222C.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4c","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"PFramework.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\PFramework.exe\" (UID: 2188)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Exhilarator\\Hub_Bandwidth64.exe\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Exhilarator\\MSIMG32.DLL\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msimg32.dll\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Exhilarator\\VERSION.DLL\"\n \"Hub_Bandwidth64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Crisp.exe\" touched file \"C:\\Windows\\Tasks\\AssistFilter_amd64.job\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$51","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002188-00000C2C-2941513085\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSARecvMsg\" (Indicator: \"WSARecv\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$53","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"WiX Toolset (4.0.0.0)\"\n \"2.5.29.35\"\n \"2.5.29.37\"\n \"0.0.0.0\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"1.0.0.0\"\n \"17.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"CONNECT %s:%s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"testmycdn.azureedge.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: fc54e0d16d9764783542f0146a98b300","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2FF3C56B155111E250FA53C93D4A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE09C9568BBF9A836197D9677BEAA9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE2FF3C56B155111E250FA53C93D4A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$57","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"PFramework.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Crisp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"PFramework.exe\" called \"GetComputerNameW\" (UID: 00000000-00002188)\n \"Crisp.exe\" called \"GetComputerNameW\" (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"PFramework.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"PFramework.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"PFramework.exe\" called \"GetUserNameW\" (UID: 00000000-00002188)\n \"PFramework.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwReadFile\" (Indicator: \"ZwReadFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"CsrGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtWow64CsrGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwWow64CsrGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"NtGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlCheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$60","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Hub_Bandwidth64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"PFramework.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")\n Found string \"AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"NtDeleteKey\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry deletion API: \"RtlDeleteRegistryValue\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteKey\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteValueKey\" in \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"PFramework.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002188)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002188.00000001.254465.03460000.00000004.mdmp, 00000000-00002188.00000002.256383.03460000.00000004.mdmp\")\n Found string \"\\Device\\IPT\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"NtDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"Found reference to API \"The range specified in NtUnlockFile was not locked.\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtLockFile\" (Indicator: \"NtLockFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtUnlockFile\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")\n Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"RtlCheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"ZwSetInformationFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 64791-7557-004E9E70","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002188.00000000.252612.01315000.00000002.mdmp, 00000000-00002188.00000001.254465.732A5000.00000002.mdmp, 00000000-00002188.00000002.256383.00E80000.00000002.mdmp, 00000000-00002188.00000002.256383.01315000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"PFramework.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"PFramework.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"PFramework.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\DNSAPI.DLL,-103\"; Value: \"Domain Name System (DNS) Server Trust\"), \"PFramework.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\n-124\"; Value: \"Document Encryption\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x.\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")\n Found reference to API \"TpCallbackReleaseMutexOnCompletion\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002188.00000001.254465.05B90000.00000004.mdmp, 00000000-00002188.00000002.256383.05596000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"26C2F9.tmp has high entropy\"\n \"Steegcriedrak.eak has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$66","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Hub_Bandwidth64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"PFramework.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"PFramework.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00005692.00000002.253295.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"BugSplat.dll\")\n file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"3b4ebe.rbs\")\n file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"MSI4F88.tmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Crisp.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00006268)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to discover peripheral devices using WMI","description":"\"PFramework.exe\" issued a query \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\"","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-91","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"PFramework.exe\" issued a query \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\"\n \"PFramework.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Hub_Bandwidth64.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Exhilarator\\SlideShowEditor.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$67","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$68","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%LOCALAPPDATA%\\PFramework.exe\" connects to 45.133.74.65 on port 56001 (TCP)\n Process \"%LOCALAPPDATA%\\PFramework.exe\" connects to 199.232.210.172 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$69","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Hub_Bandwidth64.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\26C2F9.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Hub_Bandwidth64.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\26C2F9.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: 64791-977-004D35C0]","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":5,"id":"string-344","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 73211 bytes 1 file at 0x2c last modified Sun Aug 26 2025 13:00:02 +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002188]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%LOCALAPPDATA%\\Exhilarator\\Hub_Bandwidth64.exe\" spawned likely due to injection\n Process \"%ALLUSERSPROFILE%\\executor\\Hub_Bandwidth64.exe\" spawned likely due to injection\n Process \"%LOCALAPPDATA%\\PFramework.exe\" spawned likely due to injection\n Process \"%APPDATA%\\executor\\Crisp.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"$6b","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73D10000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler interface DLL","description":"\"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\mstask.dll\" at 73150000","origin":"Loaded Module","mitre_attack_id":"T1053","relevance":5,"id":"module-5","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.133.74.65 on port 56001","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"PFramework.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ATOMIC\\LOCAL STORAGE\\LEVELDB\"\n \"PFramework.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"PFramework.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\KEYSTORE\"\n \"PFramework.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"PFramework.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\COM.LIBERTY.JAXX\\INDEXEDDB\"\n \"PFramework.exe\" trying to touch file \"%APPDATA%\\ATOMIC\\LOCAL STORAGE\\LEVELDB\"\n \"PFramework.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"PFramework.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\KEYSTORE\"\n \"PFramework.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"PFramework.exe\" trying to touch file \"%APPDATA%\\COM.LIBERTY.JAXX\\INDEXEDDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$6c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"PFramework.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":145,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"698550c016eea788cd0fc8ac","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU"],"submit_name":"TASCJBAO.msi","analysis_start_time":"2026-02-06T02:24:01+00:00","indicators_count":{"informative":192,"suspicious":42,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.133.74.65","port":56001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"dns_resolutions":[{"domain":"testmycdn.azureedge.net","ttl":60,"country":"-","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}],"processes":[{"pid":4684,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\TASCJBAO.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00004684","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5860,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00005860","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":4716,"ppid":5860,"name":"Hub_Bandwidth64.exe","command_line":"","sha256":"44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35","normalized_path":"%LOCALAPPDATA%\\Exhilarator\\Hub_Bandwidth64.exe","parent_uid":"00000000-00005860","uid":"00000000-00004716"},{"pid":5692,"ppid":4716,"name":"Hub_Bandwidth64.exe","command_line":"","sha256":"44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35","normalized_path":"%ALLUSERSPROFILE%\\executor\\Hub_Bandwidth64.exe","parent_uid":"00000000-00004716","uid":"00000000-00005692"},{"pid":2188,"ppid":5692,"name":"PFramework.exe","command_line":"","sha256":"6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23","normalized_path":"%LOCALAPPDATA%\\PFramework.exe","parent_uid":"00000000-00005692","uid":"00000000-00002188"},{"pid":6268,"ppid":5692,"name":"Crisp.exe","command_line":"","sha256":"c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a","normalized_path":"%APPDATA%\\executor\\Crisp.exe","parent_uid":"00000000-00005692","uid":"00000000-00006268"}],"all_imported_dlls":["powrprof.dll","netapi32.dll","msimg32.dll","sechost.dll","wintrust.dll","msihnd.dll","MpOAV.dll","secur32.dll","System.Drawing.dll","msvcrt.dll","coml2.dll","msctf.dll","propsys.dll","WS_ImageProc.dll","winhttp.dll","xmllite.dll","mscoreei.dll","user32.dll","IPHLPAPI.DLL","bcrypt.dll","winmmbase.dll","wbemsvc.dll","AcLayers.dll","kernel.appcore.dll","wkscli.dll","wow64cpu.dll","fastprox.dll","WS_Log.dll","NLEResource.dll","System.ni.dll","userenv.dll","COMSupport.dll","winmm.dll","System.Windows.Forms.dll","kernel32.dll","win32u.dll","comctl32.dll","FWPUCLNT.DLL","netutils.dll","RTWorkQ.dll","rsaenh.dll","gpapi.dll","OnDemandConnRouteHelper.dll","amsi.dll","clrcompression.dll","version.dll","SHCore.dll","cryptbase.dll","DVDSetting.dll","WsBurn.dll","wmiutils.dll","webio.dll","vssapi.dll","NLETransitionMgr.dll","cryptsp.dll","iertutil.dll","gdi32full.dll","bcryptprimitives.dll","ole32.dll","ntasn1.dll","WSUtilities.dll","schannel.dll","combase.dll","fusion.dll","wbemcomn.dll","mswsock.dll","System.Xml.ni.dll","shell32.dll","msi.dll","windows.storage.dll","oleaut32.dll","dwmapi.dll","mscoree.dll","BugSplat.dll","System.Core.ni.dll","ntdll.dll","advapi32.dll","srclient.dll","vsstrace.dll","ntmarta.dll","clrjit.dll","cryptnet.dll","winnsi.dll","wow64.dll","wbemprox.dll","rasadhlp.dll","taskschd.dll","setupapi.dll","GdiPlus.dll","VxSSL32.dll","psapi.dll","dhcpcsvc.dll","WindowsCodecs.dll","mstask.dll","cfgmgr32.dll","KernelBase.dll","imm32.dll","clr.dll","System.Configuration.ni.dll","pcacli.dll","d3d9.dll","wininet.dll","nsi.dll","shlwapi.dll","sfc_os.dll","clbcatq.dll","fltLib.dll","System.Management.ni.dll","ws2_32.dll","vcruntime140_clr0400.dll","NLEService.dll","wsock32.dll","evr.dll","input.dll","N1b7J4dL.dll","rpcrt4.dll","comdlg32.dll","urlmon.dll","mscorlib.ni.dll","ncryptsslp.dll","ucrtbase.dll","apphelp.dll","gdi32.dll","srpapi.dll","wldp.dll","sspicli.dll","wow64win.dll","imagehlp.dll","profapi.dll","crypt32.dll","uxtheme.dll","mpr.dll","RstrtMgr.dll","cabinet.dll","WMINet_Utils.dll","dnsapi.dll","msvcp_win.dll","sfc.dll","msasn1.dll","spp.dll","ucrtbase_clr0400.dll","ncrypt.dll","mskeyprotect.dll","CoreMessaging.dll","dhcpcsvc6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DBGHelp.dll","sha256":"c1275ddf04a0942b416c1a0b2d32003a4eda732c6f97c74181c236e35d12420f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Hub_Bandwidth64.exe","sha256":"44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"3b4ebd.msi","sha256":"3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"BugSplat.dll","sha256":"4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"COMSupport.dll","sha256":"b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"DVDSetting.dll","sha256":"718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Drangkingais.dmox","sha256":"e6d1735dc1a02c3e2075adb1cf23f2e0aeaaed86275b57d897b2eee779fc8cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"ExceptionHandler.dll","sha256":"6036be1c9a8819998ad10879dff6c04edc787d34a142a3e0841c0fca36fb9c6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"NLEResource.dll","sha256":"00658b09662cbf11059de783439552182b0bf76d2184e3f57b7b29450c486ea2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"NLEService.dll","sha256":"8e0607837da399f4f81974a793eb7121ecf8fca337730200cd88e7e9881235bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"NLETransitionMgr.dll","sha256":"41050f6f6919a4516d481f7c9b5fe6074c447afc6e9cc28d180982eea50ae165","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"SlideShowEditor.ini","sha256":"d8da65acc79167d53decab2d59c3f6dbfba37fb20fcdbfe3e260a9a8b45597f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Steegcriedrak.eak","sha256":"4f13f999cb7053b1ea05cf3036b34de5c05b8f3369f5efdb0387ef1e00bbe63e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"WSUtilities.dll","sha256":"30b9b877aa1112105069be6b4de794b7a7147a1d968e71fa63f2edc7397e126f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"WS_ImageProc.dll","sha256":"58ef42507d9fc1e8a7b240ef5cddc9f600c3d9a61ee6a42a4045278bb332b86a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"WS_Log.dll","sha256":"e841fe9fa09ddc4292f22db95cb2d348d8f37594513f5848d545db92e3b07c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"WsBurn.dll","sha256":"8fcae9719a3f831cb73ef50b587a6222ff73d6c1a6ae617636cb31c6e02d5e3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"Crisp.exe","sha256":"c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"PFramework.exe","sha256":"6bd2ecf9d4f26dbfb21ecc33715cfa505859bf72e208483619378be16655fc23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"AssistFilter_amd64.job","sha256":"7ab596b5adfcabde5e17755b412adc478070e4a9fa7298042454a705215b1fe4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"name":"3b4ebf.msi","sha256":"3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Exhilarator\\Drangkingais.dmox","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\BugSplat.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\COMSupport.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\DBGHelp.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\Drangkingais.dmox","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\DVDSetting.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\ExceptionHandler.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\Hub_Bandwidth64.exe","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\NLEResource.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\NLEService.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\NLETransitionMgr.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\SlideShowEditor.ini","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\WsBurn.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\WSUtilities.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\WS_ImageProc.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\WS_Log.dll","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%ALLUSERSPROFILE%\\executor\\Steegcriedrak.eak","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%TEMP%\\26C2F9.tmp","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%APPDATA%\\executor\\Crisp.exe","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%TEMP%\\271B19.tmp","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%TEMP%\\27E222C.tmp","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%LOCALAPPDATA%\\PFramework.exe","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"path":"%WINDIR%\\Tasks\\AssistFilter_amd64.job","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"698550c016eea788cd0fc8ac"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["698550c016eea788cd0fc8ac"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 3bdb6d2cc212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3bdb6d2cc212…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 3bdb6d2cc212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3bdb6d2cc212…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3bdb6d2cc2125ca6b5c61dbbee32b5b625d96378064df19c506ec04487834a96"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 3bdb6d2cc212… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3bdb6d2cc212…. Threat score 100/100. 0/26 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6d","11",{}]]