26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T46d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Malware Sample 562d8f8381ad… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 562d8f8381ad…. Malware family: TR/Malware. Threat score 100/100. 1/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d","keywords":["Malicious","TR/Malware","malware analysis","sandbox report","threat intelligence","562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d"],"about":{"@type":"SoftwareApplication","name":"YRJKHYWK.msi","applicationCategory":["msi","data"],"identifier":"562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Malware","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1e6c,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")28:T18ae,Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlWow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlWow64SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")29:T832,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")2a:Taf0,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")2b:T1cb9,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp")2c:T1260,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")2d:T651,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")2e:T564,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")2f:T84e,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")30:T5be,Found PE header "MZ" - Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000001.176073.06581000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000002.177992.03CD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001628.00000002.177992.06C50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000001.174570.17040000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000001.174570.17600000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004384.00000001.176477.04B10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004384.00000001.176477.04B2A000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp")31:T12c1,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001628-24570-279-00DB1270 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001628-24570-279-00DB1270 Assembly shows XOR instruction xor edi 756E6547h in Stream UID: 00000000-00004384-25950-21-00C98F26 Assembly shows XOR instruction xor eax 49656E69h in Stream UID: 00000000-00004384-25950-21-00C98F26 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00004384-25950-21-00C98F26 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-40-00CA295A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-40-00CA295A Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00004384-25950-41-00CA26D4 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00004384-25950-41-00CA26D4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-49-00CA2904 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-49-00CA2904 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-54-00C9E52F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-54-00C9E52F Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00004384-25950-65-00CA3A27 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00004384-25950-65-00CA3A27 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00004384-25950-65-00CA3A27 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00004384-25950-65-00CA3A27 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-76-00CA9818 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-76-00CA9818 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-158-00C9F949 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-158-00C9F949 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-181-00CA3033 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-181-00CA3033 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004384-25950-287-00C944D1 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004384-25950-287-00C944D1 Assembly shows XOR instruction xor esi dword ptr [00CBD730h] in Stream UID: 00000000-00004384-25950-355-00C9876B Assembly shows XOR instruction xor esi dword ptr [00CBD72Ch] in Stream UID: 00000000-00004384-25950-359-00C98849 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00004384-25950-364-00C9CEF4 Assembly shows XOR instruction xor edi dword ptr [00CBC070h] in Stream UID: 00000000-00004384-25950-364-00C9CEF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-394-00CA227A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-394-00CA227A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-409-00CA0BD8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-409-00CA0BD8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-412-00CA2A1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-412-00CA2A1D Assembly shows XOR instruction xor eax dword ptr [00CBC070h] in Stream UID: 00000000-00004384-25950-418-00CA260E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-424-00CA29B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-424-00CA29B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-440-00CA2BB3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-440-00CA2BB3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-441-00CA2AE6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-441-00CA2AE6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-445-00CA8CBB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-445-00CA8CBB Assembly shows XOR instruction xor esi dword ptr [00CBC070h] in Stream UID: 00000000-00004384-25950-515-00C98198 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-525-00C977D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004384-25950-525-00C977D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004384-25950-557-00C97C0D32:Ta65a,Found XOR loop in file "Celerity-Monitor.exe" at offset 1145500; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 1879468; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2534252; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2542664; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2703642; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2707810; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2710410; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 2971775; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3035584; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3090016; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3242895; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3284040; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3313883; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 3505086; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4055859; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4066185; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4173142; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4191690; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4225157; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4233439; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4423945; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4432781; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 4520543; code bytes = 30d0 Found XOR loop in file "Celerity-Monitor.exe" at offset 149249; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149273; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149298; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149323; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149348; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149373; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149395; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149417; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149439; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149461; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149483; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149505; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149527; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149549; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149571; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149593; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149615; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149637; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149659; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149680; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149700; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149720; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149740; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149760; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149780; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149800; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149820; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149840; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149860; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149880; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149900; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149920; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149940; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149960; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 149980; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150000; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150020; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150099; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150141; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150163; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150185; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150207; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150229; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150251; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150273; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150295; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150317; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150339; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150361; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150383; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150405; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150715; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150774; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150797; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150838; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150850; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150918; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 150955; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151054; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151105; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151133; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151144; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151179; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151212; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 151834; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152088; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152137; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152257; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152278; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152401; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152432; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152547; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152571; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 152666; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154592; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154655; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154687; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154802; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154913; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 154929; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 155097; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 155100; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 155160; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 155251; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 155386; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157025; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157116; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157203; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157456; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157541; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157619; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157794; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157830; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 157940; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 158008; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 158034; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 158264; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 158453; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 158901; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 159042; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 159110; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 164895; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 164904; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 164990; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 164999; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165086; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165095; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165182; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165191; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165933; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 165942; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166032; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166041; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166127; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166139; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166174; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 166187; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 172660; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 172839; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 179815; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 179824; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 179912; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 179921; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180008; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180017; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180105; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180114; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180202; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180211; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180299; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180308; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180403; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180412; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180497; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 180509; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 184389; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 189630; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 189822; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 189828; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 191161; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 191347; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 191353; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 192903; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 193147; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 193390; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 441425; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 441437; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 441449; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 777449; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 970056; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1144329; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1245094; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477248; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477269; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477280; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477291; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477302; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477313; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477324; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1477335; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1503817; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 1811948; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 2538840; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 2953908; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 2960350; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 2971757; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 2990161; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3029338; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3271811; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3384321; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3391760; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3399351; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3414858; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3463038; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3733808; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3778963; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3785489; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3892170; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 3915446; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4028795; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4096400; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4123078; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4190509; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4229790; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4276586; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4403331; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4413124; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4438619; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4441164; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4522591; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4601425; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 4632311; code bytes = 33c1 Found XOR loop in file "Celerity-Monitor.exe" at offset 148325; code bytes = 30040e Found XOR loop in file "Celerity-Monitor.exe" at offset 222580; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 288231; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 519722; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 543609; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 655312; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 655740; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 656007; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 656414; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 656798; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1219868; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1429996; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1466544; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1466675; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1629852; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 1965544; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2265137; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2318475; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2363293; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2384615; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2425300; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2429643; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2553644; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2584904; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2596007; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 2596935; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3025913; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3310898; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3313861; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3314103; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3338177; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3415026; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3428446; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3582003; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3594150; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3613247; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3681252; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3685995; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3693515; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3694476; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3712719; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3923239; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3954725; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3969790; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 3977754; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4058603; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4081373; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4120163; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4218065; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4275120; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4458134; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4748854; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4755987; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4756234; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4758833; code bytes = 8030 Found XOR loop in file "Celerity-Monitor.exe" at offset 4763736; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3136484; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 3241586; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 3339432; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 3782188; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 3921800; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 3988636; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 4137659; code bytes = 30d0 Found XOR loop in file "sciter-x.dll" at offset 457640; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 783677; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 810765; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 810864; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 810985; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 843125; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1059426; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1220198; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1220314; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1220436; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1770908; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 1879630; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2187502; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2187528; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2277835; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2341389; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2468548; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2531097; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 2835372; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 3034262; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 3035362; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 3112249; code bytes = 33c1 Found XOR loop in file "sciter-x.dll" at offset 3244011; code bytes = 30040e Found XOR loop in file "sciter-x.dll" at offset 3357056; code bytes = 30040e Found XOR loop in file "sciter-x.dll" at offset 57187; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 57215; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 57240; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 57362; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 57392; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 67917; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 88180; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 163656; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 163681; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 189056; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 193353; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 230197; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 230371; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 263602; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 297235; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 320289; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 320429; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 325111; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 325250; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 339577; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 347847; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 399746; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 438960; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 495998; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 500079; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 500908; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 500927; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 505964; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 505988; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 506012; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 506184; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 506208; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 506232; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 511664; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 511905; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 530292; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 530649; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 557983; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 559524; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 679349; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 718881; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 731371; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 731609; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 733349; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 735050; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 739355; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 741147; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 746732; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 801251; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 905325; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1101074; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1145919; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1146123; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1146316; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1173265; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1173711; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1186900; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1190498; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1293278; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1294155; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1294182; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1294256; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1294283; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1299168; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1302800; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1306283; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1307948; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1312262; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1360665; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1371675; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1412153; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1412182; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1415110; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1415607; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1423583; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1443858; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1460059; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1488711; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1493934; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1537311; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1543815; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1583776; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1605054; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1622956; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1625658; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1849020; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1854848; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1854990; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1936795; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 1999306; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2010767; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2028310; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2028761; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2077677; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2078116; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2079863; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2080110; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2080476; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2093047; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2095362; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2105289; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2105388; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2111433; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2143505; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2163775; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2167940; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2276576; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2363589; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2671824; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2683606; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2683970; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2705706; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2730276; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2730302; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 2731985; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3247936; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3255871; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3302730; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3322979; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3347536; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3446544; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3446592; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675815; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675858; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675863; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675868; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675879; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675884; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675889; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675894; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675904; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675909; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675914; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675919; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3675924; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3683358; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3695662; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3706670; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3709184; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3739648; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741602; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741607; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741612; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741617; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741627; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741632; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741637; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741642; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3741647; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3760234; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3760580; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3768194; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3773978; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3783841; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3819677; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3824695; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3824811; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 3827149; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4020268; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4051132; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4150944; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4200502; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4207641; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4207888; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4210487; code bytes = 8030 Found XOR loop in file "sciter-x.dll" at offset 4215390; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 184651; code bytes = 33c1 Found XOR loop in file "MSVCP140.dll" at offset 335552; code bytes = 33c1 Found XOR loop in file "MSVCP140.dll" at offset 349606; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 408152; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 542568; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 560677; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 562476; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 567856; code bytes = 8030 Found XOR loop in file "MSVCP140.dll" at offset 572759; code bytes = 8030 Found XOR loop in file "ProtobufLite.dll" at offset 101868; code bytes = 30d0 Found XOR loop in file "ProtobufLite.dll" at offset 261568; code bytes = 30d0 Found XOR loop in file "ProtobufLite.dll" at offset 306772; code bytes = 30d0 Found XOR loop in file "ProtobufLite.dll" at offset 506564; code bytes = 30d0 Found XOR loop in file "ProtobufLite.dll" at offset 10007; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 10027; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 17737; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 17757; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 232283; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 253184; code bytes = 33c1 Found XOR loop in file "ProtobufLite.dll" at offset 526902; code bytes = 8030 Found XOR loop in file "ProtobufLite.dll" at offset 534034; code bytes = 8030 Found XOR loop in file "ProtobufLite.dll" at offset 534281; code bytes = 8030 Found XOR loop in file "ProtobufLite.dll" at offset 536880; code bytes = 8030 Found XOR loop in file "ProtobufLite.dll" at offset 541783; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 28812; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 37750; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 280871; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 315059; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 316181; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 317147; code bytes = 30d0 Found XOR loop in file "Crisp.exe" at offset 34975; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 35106; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 266601; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 313049; code bytes = 33c1 Found XOR loop in file "Crisp.exe" at offset 144820; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 157178; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 285023; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 288820; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 288920; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 315040; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 317128; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 324884; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 328132; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 328379; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 334685; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 337284; code bytes = 8030 Found XOR loop in file "Crisp.exe" at offset 337531; code bytes = 8030 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28585; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28606; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28627; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28696; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28788; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 28887; code bytes = 33c1 Found XOR loop in file "EXEMessenger_net40.exe" at offset 2731; code bytes = 8030 Found XOR loop in file "EXEMessenger_net40.exe" at offset 123252; code bytes = 8030 Found XOR loop in file "EXEMessenger_net40.exe" at offset 124607; code bytes = 8030 Found XOR loop in file "EXEMessenger_net40.exe" at offset 128940; code bytes = 8030 Found XOR loop in file "EXEMessenger_net40.exe" at offset 132430; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 65756; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 106285; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 111668; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 116571; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 118889; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 15211; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 35126; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 45446; code bytes = 803033:T89e,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")34:T426,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found string "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")35:Ta7e,Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSidEx" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSidEx" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")36:T1693,Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "NtWow64GetNativeSystemInformation" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "ZwWow64GetNativeSystemInformation" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp"37:T46c,Found reference to API "RtlGetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlpGetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlpGetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")38:T44a,Found reference to API "NtQueryDefaultUILanguage" (Indicator: "ntquerydefaultuilanguage"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInstallUILanguage" (Indicator: "ntqueryinstalluilanguage"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryDefaultUILanguage" (Indicator: "ntquerydefaultuilanguage"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryInstallUILanguage" (Indicator: "ntqueryinstalluilanguage"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")39:T44a,Found reference to API "NtQueryDefaultUILanguage" (Indicator: "NtQueryDefaultUILanguage"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInstallUILanguage" (Indicator: "NtQueryInstallUILanguage"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryDefaultUILanguage" (Indicator: "NtQueryDefaultUILanguage"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryInstallUILanguage" (Indicator: "NtQueryInstallUILanguage"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")3a:T76a,"EXEMessenger_net40.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001628) "Crisp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000004051c50b0000600088ed3c005800167738f53c00a0185a72c45ca279feffffffa8f43c005c7f587258f43c0010f53c0000000000757f587210f53c00ffffffffffffffff230000000000000010f53c00000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff230000000000000010f53c00000000001c000000000000000000000000000000000000005851c50b48f53c00 (UID: 00000000-00004384) "Crisp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004384)3b:T48e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")3c:T48e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")3d:T189c,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp")3e:T46a,Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryVolumeInformationFile" (Indicator: "ZwQueryVolumeInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryVolumeInformationFile" (Indicator: "ZwQueryVolumeInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")3f:T618,Found registry modification API: "RegCreateKeyExW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry modification API: "ZwCreateKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransacted" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEvent" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry modification API: "ZwCreateKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransacted" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEvent" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp"40:T784,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetProcessHeaps" (Indicator: "RtlGetProcessHeaps"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenProcess" (Indicator: "ZwOpenProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenProcess" (Indicator: "NtOpenProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlGetProcessHeaps" (Indicator: "RtlGetProcessHeaps"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenProcess" (Indicator: "ZwOpenProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")41:Te71,"EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter ktmw32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter credui.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00001628) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004384) "Crisp.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004384)42:T2e3c,"EXEMessenger_net40.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtWorkerFactoryWorkerReady (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter LdrShutdownThread (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtQueryInformationToken (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001628) "EXEMessenger_net40.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001628) "Crisp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004384) "Crisp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004384)43:T11e4,Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "odCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found reference to API "odCreateProcess64" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")44:T916,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")45:Taf7,Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")46:T1484,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")47:T1890,Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")48:T7d6,Found reference to API "NtOpenEvent" (Indicator: "NtOpenEvent"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenEventPair" (Indicator: "NtOpenEvent"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenEvent" (Indicator: "ZwOpenEvent"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenEventPair" (Indicator: "ZwOpenEvent"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenEvent" (Indicator: "NtOpenEvent"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenEventPair" (Indicator: "NtOpenEvent"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenEvent" (Indicator: "ZwOpenEvent"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwOpenEventPair" (Indicator: "ZwOpenEvent"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")49:T196c,Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")4a:T498,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp")4b:T5ef9,"SOFTWARE\360MachineSignature" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\EarlyLaunch" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\WOW6432Node\360Safe\safemon" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\360Safe\safemon" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "System\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001628.00000001.176073.03CE0000.00000004.mdmp 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp "{"type":2048,"id":1254547289,"frameId":3160425367,"action":0,"data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\" \"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\" \"include_filter\":\"KgA=\" \"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\" \"include_regex\":0 \"exclude_regex\":0}" in Source: 00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp, "7 "action":0 "data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\",\"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\",\"include_filter\":\"KgA=\",\"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\",\"include_regex\":0,\"exclude_regex\":0},{\"name\":\"QgBpAHQAYwBvAGkAbgBDAG8AcgBlAA==\",\"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwAfAAlAEwAbwBjAGEAbABBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwA\",\"include_filter\":\"KgB3AGEAbABsAGUAdAAuAGQAYQB0AA==\",\"exclude_filter\":\"\",\"include_regex\":0,\"exclude_regex\":0},{\"name\":\"QwBvAGkAbgBvAG0AaQA=\",\"search_path\":\"JQBMAG8AYwBhAGwAQQBwAHAARABhAHQAYQAlAFwAQwBvAGkAbgBvAG0AaQBcAEMAbwBpAG4AbwBtAGkAXAB3AGEAbABsAGUAdABzAA==\",\"include_filter\":\"KgA=\",\"exclude_filter\":\"\",\"include_regex\":0,\"exclude_regex\":0},{\"na_" in Source: 00000000-00001628.00000001.176073.03D1F000.00000004.mdmp, 00000000-00001628.00000002.177992.03D1F000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Software\Microsoft\Windows" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp, "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Software\Microsoft\Windows" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp 00000000-00004376.00000001.174570.17040000.00000004.mdmp 00000000-00004376.00000001.174570.17220000.00000004.mdmp4c:T45f,Antivirus vendors marked dropped file "28b92b.msi" as clean (type is "Composite Document File V2 Document Cannot read short stream") Antivirus vendors marked dropped file "EXEMessenger_net40.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "Celerity-Monitor.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "sciter-x.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "MSVCP140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "ProtobufLite.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "vcruntime140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections")4d:T5c9,"Celerity-Monitor.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "sciter-x.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MSVCP140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ProtobufLite.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Crisp.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "EXEMessenger_net40.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF4e:Tdcde,"SOFTWARE\360MachineSignature" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\EarlyLaunch" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SOFTWARE\WOW6432Node\360Safe\safemon" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SOFTWARE\360Safe\safemon" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "System\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe" in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp "SOFTWARE\360MachineSignature" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\EarlyLaunch" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\WOW6432Node\360Safe\safemon" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\360Safe\safemon" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "System\CurrentControlSet\Services\%s" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe" in Source: 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp "{"type":2048,"id":1254547289,"frameId":3160425367,"action":0,"data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\" \"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\" \"include_filter\":\"KgA=\" \"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\" \"include_regex\":0 \"exclude_regex\":0}" in Source: 00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, "7 "action":0 "data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\",\"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\",\"include_filter\":\"KgA=\",\"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\",\"include_regex\":0,\"exclude_regex\":0},{\"name\":\"QgBpAHQAYwBvAGkAbgBDAG8AcgBlAA==\",\"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwAfAAlAEwAbwBjAGEAbABBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwA\",\"include_filter\":\"KgB3AGEAbABsAGUAdAAuAGQAYQB0AA==\",\"exclude_filter\":\"\",\"include_regex\":0,\"exclude_regex\":0},{\"name\":\"QwBvAGkAbgBvAG0AaQA=\",\"search_path\":\"JQBMAG8AYwBhAGwAQQBwAHAARABhAHQAYQAlAFwAQwBvAGkAbgBvAG0AaQBcAEMAbwBpAG4AbwBtAGkAXAB3AGEAbABsAGUAdABzAA==\",\"include_filter\":\"KgA=\",\"exclude_filter\":\"\",\"include_regex\":0,\"exclude_regex\":0},{\"na_" in Source: 00000000-00001628.00000001.176073.03D1F000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Software\Microsoft\Windows" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Software\Microsoft\Windows" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00001628.00000001.176073.06581000.00000004.mdmp, "{"type":2048 "id":1254547289 "frameId":3160425367 "action":0 "data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\",\"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\",\"include_filter\":\"KgA=\",\"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\",\"include_regex\":0,\"exclude_regex\":0}" in Source: 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp "7,"action":0,"data":"{\"software\":[{\"name\":\"QQB0AG8AbQBpAGMA\" \"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABhAHQAbwBtAGkAYwA=\" \"include_filter\":\"KgA=\" \"exclude_filter\":\"KgBjAGEAYwBoAGUAXAAqAA==\" \"include_regex\":0 \"exclude_regex\":0} {\"name\":\"QgBpAHQAYwBvAGkAbgBDAG8AcgBlAA==\" \"search_path\":\"JQBBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwAfAAlAEwAbwBjAGEAbABBAHAAcABEAGEAdABhACUAXABCAGkAdABjAG8AaQBuAFwA\" \"include_filter\":\"KgB3AGEAbABsAGUAdAAuAGQAYQB0AA==\" \"exclude_filter\":\"\" \"include_regex\":0 \"exclude_regex\":0} {\"name\":\"QwBvAGkAbgBvAG0AaQA=\" \"search_path\":\"JQBMAG8AYwBhAGwAQQBwAHAARABhAHQAYQAlAFwAQwBvAGkAbgBvAG0AaQBcAEMAbwBpAG4AbwBtAGkAXAB3AGEAbABsAGUAdABzAA==\" \"include_filter\":\"KgA=\" \"exclude_filter\":\"\" \"include_regex\":0 \"exclude_regex\":0} {\"na_" in Source: 00000000-00001628.00000002.177992.03D1F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00001628.00000002.177992.060A0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004376.00000001.174570.17040000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004376.00000001.174570.17220000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\VAN\{6705C562-0AE7-40EA-8474-F39DAB1813D0}" in Source: 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp "Software\Microsoft\RAS AutoDial" in Source: 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp "System\CurrentControlSet\Services\rasman\IKEv2" in Source: 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Parameters\Config\Phonebooks" in Source: 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp "SOFTWARE\MICROSOFT\DIRECTX" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\ESET Security\CurrentVersion\Info" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\RemoteAdministrator\Agent\CurrentVersion\Info" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\ESET Security\CurrentVersion\Plugins" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion\Header" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion\Recent" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\.esil" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\ESET.SysInspector" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\.esil_auto_file" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\Applications\SysInspector.exe" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\ESET.SysInspector\shell\open\command" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\esil_auto_file\shell\open\command" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\esil_auto_file" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "SOFTWARE\Classes\.esil_auto_file\shell\open\command" in Source: 00000000-00004376.00000002.176233.C888C000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004384.00000001.176477.00610000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00004384.00000001.176477.04B2A000.00000004.mdmp "SOFTWARE\MICROSOFT\DIRECTX" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\ESET Security\CurrentVersion\Info" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\RemoteAdministrator\Agent\CurrentVersion\Info" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\ESET Security\CurrentVersion\Plugins" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion\Header" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\ESET\ESET Sysinspector\CurrentVersion\Recent" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\.esil" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\ESET.SysInspector" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\.esil_auto_file" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\Applications\SysInspector.exe" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\ESET.SysInspector\shell\open\command" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\esil_auto_file\shell\open\command" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\esil_auto_file" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "SOFTWARE\Classes\.esil_auto_file\shell\open\command" in Source: 00000000-00005684.00000001.172333.5022C000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005684.00000001.172333.C6EF0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00005684.00000001.172333.CDFB7000.00000004.mdmp4f:T48c,"EXEMessenger_net40.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "EXEMessenger_net40.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "EXEMessenger_net40.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "EXEMessenger_net40.exe" loaded module "KERNEL32" at base 73b00000 "EXEMessenger_net40.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72520000 "EXEMessenger_net40.exe" loaded module "MSVCRT.DLL" at base 74890000 "EXEMessenger_net40.exe" loaded module "RPCRT4.DLL" at base 76fa0000 "EXEMessenger_net40.exe" loaded module "USER32.DLL" at base 743b0000 "Crisp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "Crisp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "Crisp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "Crisp.exe" loaded module "KERNEL32" at base 73b00000 "Crisp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72520000 "Crisp.exe" loaded module "MSVCRT.DLL" at base 74890000 "Crisp.exe" loaded module "RPCRT4.DLL" at base 76fa0000 "Crisp.exe" loaded module "USER32.DLL" at base 743b000050:T609,"562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d.bin" was detected as "Microsoft Installer(MSI)" and name: "Installer" "562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d.bin" was detected as "Microsoft Compound" and name: "Data" "Celerity-Monitor.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Celerity-Monitor.exe" was detected as "Microsoft Compound" and name: "Data" "sciter-x.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "sciter-x.dll" was detected as "Microsoft Compound" and name: "Data" "MSVCP140.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "MSVCP140.dll" was detected as "Microsoft Compound" and name: "Data" "ProtobufLite.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "ProtobufLite.dll" was detected as "Microsoft Compound" and name: "Data" "Crisp.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Crisp.exe" was detected as "Microsoft Compound" and name: "Data" "EXEMessenger_net40.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "EXEMessenger_net40.exe" was detected as "Microsoft Compound" and name: "Data" "VCRUNTIME140.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "VCRUNTIME140.dll" was detected as "Microsoft Compound" and name: "Data" "vcruntime140_1.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "vcruntime140_1.dll" was detected as "Microsoft Compound" and name: "Data"51:T57d,"EXEMessenger_net40.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "EXEMessenger_net40.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "EXEMessenger_net40.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "EXEMessenger_net40.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "EXEMessenger_net40.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "EXEMessenger_net40.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Crisp.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") "Crisp.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Crisp.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Crisp.exe" touched "Background Intelligent Transfer Control Class 1.0" (Path: "HKCU\WOW6432NODE\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\TREATAS")52:T49a,Process "msiexec.exe" (UID: 00000000-00005812) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00005812) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "Celerity-Monitor.exe" (UID: 00000000-00005684) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "Celerity-Monitor.exe" (UID: 00000000-00005684) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "Celerity-Monitor.exe" (UID: 00000000-00004376) was launched with new environment variables: "NFSRUVMNVDFTOGPZQOCNXCATH="iaomjoj"" Process "EXEMessenger_net40.exe" (UID: 00000000-00001628) was launched with new environment variables: "JPOHOMJYSQGBTTZLEBEH="%TEMP%\7C464AE.tmp""53:Ta16,Found reference to API "LdrLoadDll" (Indicator: "LdrLoadDll"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetDllHandleEx" (Indicator: "LdrGetDllHandle"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetDllHandle" (Indicator: "LdrGetDllHandle"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetDllHandleByMapping" (Indicator: "LdrGetDllHandle"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetDllHandleByName" (Indicator: "LdrGetDllHandle"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrLoadDll" (Indicator: "LdrLoadDll"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetDllHandleEx" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetDllHandle" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetDllHandleByMapping" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetDllHandleByName" (Indicator: "LdrGetDllHandle"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")54:T42a,Found reference to API "NtRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")55:T80e,Found reference to API "NtQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")56:T11a7,"28b92b.msi" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "Celerity-Monitor.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\Celerity-Monitor.exe]- [targetUID: 00000000-00004384] "sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\ProtobufLite.dll]- [targetUID: 00000000-00005684] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\winrepository_v2_0\Crisp.exe]- [targetUID: 00000000-00004384] "EXEMessenger_net40.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\EXEMessenger_net40.exe]- [targetUID: 00000000-00001628] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\Broadway\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\vcruntime140_1.dll]- [targetUID: 00000000-00005684] "7C464AE.tmp" has type "data"- Location: [%TEMP%\7C464AE.tmp]- [targetUID: 00000000-00001628] "context-prime.lock" has type "data"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\context-prime.lock]- [targetUID: 00000000-00005684] "ngen.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (337) with CRLF line terminators"- [targetUID: N/A] "inprogressinstallinfo.ipi" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "SourceHash_DEB890C4-AA1B-4206-A08F-7F9BB85DAFC9_" has type "Unknown"- [targetUID: N/A] "filter-config.tmp" has type "data"- Location: [%LOCALAPPDATA%\Broadway\filter-config.tmp]- [targetUID: 00000000-00005684] "28b92c.rbs" has type "data"- [targetUID: N/A] "Dekafe" has type "data"- Location: [%ALLUSERSPROFILE%\Dujixuqo\Dekafe]- [targetUID: 00000000-00001628] "MSIBE4C.tmp" has type "data"- [targetUID: N/A] "Zoceq" has type "data"- Location: [%ALLUSERSPROFILE%\Dujixuqo\Zoceq]- [targetUID: 00000000-00001628] "82390C.tmp" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID desktop-fvvf82a Archive ctime=Fri Apr 24 17:08:48 2026 atime=Fri Apr 24 17:08:48 2026 mtime=Tue Apr 14 02:05:52 2026 length=4766064 window=normal IDListSize 0x0173 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\ProgramData\winrepository_v2_0\Celerity-Monitor.exe""- Location: [%TEMP%\82390C.tmp]- [targetUID: 00000000-00004384] "28b92d.msi" has type "Composite Document File V2 Document Cannot read short stream"- [targetUID: N/A] "Celerity-Monitor.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\Celerity-Monitor.exe]- [targetUID: 00000000-00004384] "sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\ProtobufLite.dll]- [targetUID: 00000000-00005684] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\vcruntime140_1.dll]- [targetUID: 00000000-00005684] "context-prime.lock" has type "data"- Location: [%LOCALAPPDATA%\Broadway\context-prime.lock]- [targetUID: 00000000-00005684] "filter-config.tmp" has type "data"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\filter-config.tmp]- [targetUID: 00000000-00005684]57:T707,"Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")58:T71b,"sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\ProtobufLite.dll]- [targetUID: 00000000-00005684] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\Broadway\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\vcruntime140_1.dll]- [targetUID: 00000000-00005684] "sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\ProtobufLite.dll]- [targetUID: 00000000-00005684] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\vcruntime140_1.dll]- [targetUID: 00000000-00005684]59:Tb49,"Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CELERITY-MONITOR"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEPROCESSSEARCHMODE"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")5a:Tacc,"Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\WINMM.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\OLEACC.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\WINMMBASE.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\URLMON.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\WININET.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\IERTUTIL.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\CRYPTBASE.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\OLEACCRC.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\UXTHEME.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\TAPISRV.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\RASAPI32.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\RASMAN.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\MPR.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\WINMM.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\OLEACC.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\WINMMBASE.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\URLMON.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\WININET.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\IERTUTIL.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\CRYPTBASE.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\OLEACCRC.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\UXTHEME.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\TAPISRV.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\RASAPI32.DLL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\RASMAN.DLL"5b:T536,"Celerity-Monitor.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Broadway\CELERITY-MONITOR.EXE.LOCAL" "Celerity-Monitor.exe" trying to access non-existent file "C:\ProgramData\winrepository_v2_0\CELERITY-MONITOR.EXE.LOCAL" "EXEMessenger_net40.exe" trying to access non-existent file "C:\ProgramData\Dujixuqo\GOWOYO" "EXEMessenger_net40.exe" trying to access non-existent file "C:\ProgramData\Dujixuqo\Gowoyo\9677E4F9FA25DDCBFDC865010A2C21437A3EE57F" "EXEMessenger_net40.exe" trying to access non-existent file "C:\ProgramData\Dujixuqo\ZOCEQ" "EXEMessenger_net40.exe" trying to access non-existent file "C:\ProgramData\Dujixuqo\DEKAFE" "EXEMessenger_net40.exe" trying to access non-existent file "C:\ProgramData\Dujixuqo\APROOORFI" "EXEMessenger_net40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ATOMIC" "EXEMessenger_net40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\BITCOIN" "EXEMessenger_net40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BITCOIN" "EXEMessenger_net40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\LEDGER LIVE" "Crisp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EXT_GATEWAY_TEST.LNK"5c:T41a,Found reference to API "NtCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")5d:T2186,Found reference to API "An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The computer WAS able to connect on a secondary transport." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The system bios failed to connect a system interrupt to the device or bus for which the device is connected." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Please click OK to shutdown the system. You can use the recovery console to diagnose the system further." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "A system shutdown is in progress." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "You can't connect to the file share because it's not secure. This share requires the obsolete SMB1 protocol, which is unsafe and could expose your system to attack." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Indicates that there was an AuthIP failure when attempting to connect to the remote host." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The requested connect mode conflicts with an existing mode on one or more of the specified pins." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An attempt has been made to connect to a session whose video mode is not supported by the current client." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The client failed to respond to the server connect message." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Your request to connect to this Terminal server has been rejected." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Specified VidPN source cannot be used because there is no available VidPN target to connect it to." (Indicator: " connect "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Inspecting leaks at process shutdown ..." (Indicator: " shutdown "; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed." (Indicator: " connect "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "The computer WAS able to connect on a secondary transport." (Indicator: " connect "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "The system bios failed to connect a system interrupt to the device or bus for which the device is connected." (Indicator: " connect "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product." (Indicator: " shutdown "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Please click OK to shutdown the system. You can use the recovery console to diagnose the system further." (Indicator: " shutdown "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "A system shutdown is in progress." (Indicator: " shutdown "; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")5e:T672,Heuristic match: "_=`.fi" Heuristic match: "i~.ve" Heuristic match: "'h.gm" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "https://www.globalsign.com/repository/03,0*0" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0tdg" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0*g" Pattern match: "nstagram.com/justinbieber" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "ws@.ws" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=228610" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851152" Pattern match: "https://go.microsoft.com/fwlink/?linkid=852747" Heuristic match: "h`b.kp" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0"5f:T14de,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found URL "http://terrainformatica.comoriginalfilenamesciterx.dllproductnamesciter," - Source: "00000000-00004376.00000001.174570.1B61E000.00000002.mdmp") Found URL "http://terrainformatica.com/forums/topic.php?id=1772" - Source: "00000000-00004376.00000001.174570.1B61E000.00000002.mdmp") Found URL "http://www.microsoft.com/provisioning/eaphostconfig'" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/baseeapconnectionpropertiesv1'" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaptlsconnectionpropertiesv1'" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/mspeapconnectionpropertiesv1'" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found URL "https://login.microsoft.com9921cdce-9dd2-4da4-a6e9-f047e4d56dc9vpn_certcertificateusagevpn" - Source: "00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp") Found URL "http://ftp://^[_a-za-z0-9\-]+([\.]+[_a-za-z0-9\-]+)*((/[_a-za-z0-9\.\-]*)+)*(\?[_a-za-z0-9\&\=\%\,\-\!\" - Source: "00000000-00004376.00000002.176233.1B566000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdll1.2.8incorrect" - Source: "00000000-00004376.00000002.176233.1B566000.00000002.mdmp") Found URL "http://text/*http/1.1headopenmshtml.dlliexplore.exe0x%08x(a;;;;;wd);;;sy);;;ls);;;ac)s-%lu-0x%02hx%02hx%02hx%02hx%02hx%02hx-%lu\\.\ehdrv" - Source: "00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found URL "https://help.eset.com/gethelp?product=esi&version=sedebugprivilege%2x%2x%2x%2xrgb(*).sprite.svgasset:%1x%1x%1x%1x%1x%1x%1xidretryidignoreidyesidnogfx:idokidcancelidabortid_wizbackid_wiznextid_wizfinishabout_dark.svgidcloseidhelpidtryagainidcontinuecollapse_dark.svgcollapse_default.svgeset.svgeset_dark.svgabout_default.svgabout_light.svgabout_selected.svgabout_selected_dark.svghome_default.svghome_selected.svghome_selected_dark.svglog_dark.svgeset_tagline.svgexpand_dark.svgexpand_default.svghome_dark.svgopen_dark.svgsave.svgsave_dark.svgsetup_dark.svglog_default.svglog_selected.svglog_selected_dark.svgopen.svgstatistics_default.svgstatistics_selected.svgstatistics_selected_dark.svguser.svgsetup_default.svgsetup_selected.svgsetup_selected_dark.svgstatistics_dark.svgusage:" - Source: "00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found URL "http://https://connect" - Source: "00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0m0k0i/0\0zm0k0i=http://www.microsoft.com/pki/certs/microsoftcodeverifroot.crt08&v:" - Source: "00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?f%w0digicert" - Source: "00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmn" (Indicator: "GetDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp")63:T1410,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")64:T14bf,Found registry query API: "RegOpenKeyExW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "SHGetValueW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp"65:Tce8,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")66:T412,Found reference to API "NtCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")67:T1a4f,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWow64GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp")68:T493,Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")69:Tabc,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")6a:T1305,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")6b:T404,Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")6c:T65c,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")6d:T2077,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp")6e:T979,Found registry deletion API: "SHDeleteKeyW" in "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp" Found registry deletion API: "NtDeleteKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp" Found registry deletion API: "NtDeleteKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp"6f:T4e0,Found string "\drivers\" (Indicator: "\drivers\"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found string "system32\DRIVERS\" (Indicator: "\drivers\"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found string "system32\DRIVERS\" (Indicator: "system32\drivers"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp") Found string "\Device\IPT" (Indicator: "\Device\"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004376.00000000.172650.0FFF0000.00000004.mdmp, 00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp")70:T4a0,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")71:T626,Found reference to API "The range specified in NtUnlockFile was not locked." (Indicator: "NtUnlockFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtLockFile" (Indicator: "NtLockFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtUnlockFile" (Indicator: "NtUnlockFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "The range specified in NtUnlockFile was not locked." (Indicator: "NtUnlockFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtLockFile" (Indicator: "NtLockFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtUnlockFile" (Indicator: "NtUnlockFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")72:T65c,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")73:T98e,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")74:T2749,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddResourceAttributeAce" (Indicator: "AddResourceAttributeAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAddScopedPolicyIDAce" (Indicator: "AddScopedPolicyIDAce"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp")75:T920,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00004384.00000001.176477.00C91000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")76:Tc0f,"Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\WINREPOSITORY_V2_0\CELERITY-MONITOR.EXE"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\EXEMESSENGER_NET40.EXE"; Value: "") "Celerity-Monitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\WINREPOSITORY_V2_0\CRISP.EXE"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "EXEMessenger_net40.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")77:T105e,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")78:T63f,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x." (Indicator: "ReleaseMutex"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletion" (Indicator: "ReleaseMutex"; Source: "00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp") Found reference to API "After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x." (Indicator: "ReleaseMutex"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletion" (Indicator: "ReleaseMutex"; Source: "00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp")79:T441,Dropped file: "MSVCP140.dll" - Location: [%LOCALAPPDATA%\Broadway\MSVCP140.dll]- [targetUID: 00000000-00005684] Dropped file: "Crisp.exe" - Location: [%APPDATA%\winrepository_v2_0\Crisp.exe]- [targetUID: 00000000-00004384] Dropped file: "VCRUNTIME140.dll" - Location: [%LOCALAPPDATA%\Broadway\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] Dropped file: "vcruntime140_1.dll" - Location: [%LOCALAPPDATA%\Broadway\vcruntime140_1.dll]- [targetUID: 00000000-00005684] Dropped file: "filter-config.tmp" - Location: [%LOCALAPPDATA%\Broadway\filter-config.tmp]- [targetUID: 00000000-00005684] Dropped file: "Celerity-Monitor.exe" - Location: [%LOCALAPPDATA%\Broadway\Celerity-Monitor.exe]- [targetUID: 00000000-00004384] Dropped file: "sciter-x.dll" - Location: [%LOCALAPPDATA%\Broadway\sciter-x.dll]- [targetUID: 00000000-00005684] Dropped file: "ProtobufLite.dll" - Location: [%LOCALAPPDATA%\Broadway\ProtobufLite.dll]- [targetUID: 00000000-00005684] Dropped file: "context-prime.lock" - Location: [%LOCALAPPDATA%\Broadway\context-prime.lock]- [targetUID: 00000000-00005684]7a:T9f8,"Celerity-Monitor.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\Celerity-Monitor.exe]- [targetUID: 00000000-00004384] "sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\ProtobufLite.dll]- [targetUID: 00000000-00005684] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\winrepository_v2_0\Crisp.exe]- [targetUID: 00000000-00004384] "EXEMessenger_net40.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\EXEMessenger_net40.exe]- [targetUID: 00000000-00001628] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\Broadway\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\vcruntime140_1.dll]- [targetUID: 00000000-00005684] "Celerity-Monitor.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\Celerity-Monitor.exe]- [targetUID: 00000000-00004384] "sciter-x.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\sciter-x.dll]- [targetUID: 00000000-00005684] "MSVCP140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\MSVCP140.dll]- [targetUID: 00000000-00005684] "ProtobufLite.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Broadway\ProtobufLite.dll]- [targetUID: 00000000-00005684] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\VCRUNTIME140.dll]- [targetUID: 00000000-00005684] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\winrepository_v2_0\vcruntime140_1.dll]- [targetUID: 00000000-00005684]7b:T650,"Celerity-Monitor.exe" wrote 53360 bytes starting with PE header signature to file "C:\ProgramData\winrepository_v2_0\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Celerity-Monitor.exe" wrote 49792 bytes starting with PE header signature to file "C:\ProgramData\winrepository_v2_0\vcruntime140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Celerity-Monitor.exe" wrote 14544 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\winrepository_v2_0\Crisp.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Celerity-Monitor.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\EXEMessenger_net40.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000580100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7c:T7ee,"EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-journal" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-journal" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-journal" "EXEMessenger_net40.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-journal"7d:T1a87,"EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Variations" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Account Web Data" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Account Web Data-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillAiModelCache\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillAiModelCache\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillAiModelCache\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Collaboration\MessageDB" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Collaboration\MessageDB-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOCK" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DataSharing\DataSharingDB" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DataSharing\DataSharingDB-journal" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_0" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_2" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_3" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\index" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_0" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_2" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_3" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\index" "EXEMessenger_net40.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\DIPS"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790794077788,"unified_at":"2026-09-30T18:47:57.788Z","metadata":{"hashes":{"sha256":"562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d","sha1":"6e335b9bfe088ecd73b839e6629d69ec5c43a535","md5":"d9f556865406a4671d53df11689b1f64","sha512":"957b5626ddcf5a7fa7ec1bdd4eab7827ac4bdd5af37a8f954ba7629b1b75a2f1cde5f70adf0289fe26f6699dc8ed02077848d357744d7356d676fe03fb6ce7f6","ssdeep":"196608:Ogcs8Tl14t0TuL8cqRhQ9ijS4yQaBZ4ng:OKLCQShmijV8ag","ssdeep_chunks":["196608:Ogcs8Tl","196608:gcs8Tl1","196608:cs8Tl14","196608:s8Tl14t","196608:8Tl14t0","196608:Tl14t0T","196608:l14t0Tu","196608:14t0TuL","196608:4t0TuL8","196608:t0TuL8c","196608:0TuL8cq","196608:TuL8cqR","196608:uL8cqRh","196608:L8cqRhQ","196608:8cqRhQ9","196608:cqRhQ9i","196608:qRhQ9ij","196608:RhQ9ijS","196608:hQ9ijS4","196608:Q9ijS4y","196608:9ijS4yQ","196608:ijS4yQa","196608:jS4yQaB","196608:S4yQaBZ","196608:4yQaBZ4","196608:yQaBZ4n","196608:QaBZ4ng","393216:Ogcs8Tl","393216:gcs8Tl1","393216:cs8Tl14","393216:s8Tl14t","393216:8Tl14t0","393216:Tl14t0T","393216:l14t0Tu","393216:14t0TuL","393216:4t0TuL8","393216:t0TuL8c","393216:0TuL8cq","393216:TuL8cqR","393216:uL8cqRh","393216:L8cqRhQ","393216:8cqRhQ9","393216:cqRhQ9i","393216:qRhQ9ij","393216:RhQ9ijS","393216:hQ9ijS4","393216:Q9ijS4y","393216:9ijS4yQ","393216:ijS4yQa","393216:jS4yQaB","393216:S4yQaBZ","393216:4yQaBZ4","393216:yQaBZ4n","393216:QaBZ4ng","196608:OKLCQSh","196608:KLCQShm","196608:LCQShmi","196608:CQShmij","196608:QShmijV","196608:ShmijV8","196608:hmijV8a","196608:mijV8ag"],"imphash":"Unknown"},"file_info":{"file_name":"YRJKHYWK.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":6926336,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777025165000,"last_seen":1777025235000,"last_multi_scan":1777025235000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer","evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":76},"sandbox_signatures":{"informative_count":176,"suspicious_count":17,"malicious_count":7,"total":200},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Able to access mailslot-related API (String)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found registry location string related to processor"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Able to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"The cryptographic provider does not support HMAC.\" (Indicator: \"HMAC\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to \"The cryptographic provider does not support HMAC.\" (Indicator: \"HMAC\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00001628.00000001.176073.03D1F000.00000004.mdmp, 00000000-00001628.00000002.177992.03D1F000.00000004.mdmp\")\n Found string - \\.\\DISPLAY1; Source: \"00000000-00001628.00000001.176073.03D1F000.00000004.mdmp, 00000000-00001628.00000002.177992.03D1F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\APPID\\{00021401-0000-0000-C000-000000000046}\")\n \"Crisp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\APPID\\{00021401-0000-0000-C000-000000000046}\")\n \"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\APPID\\{00021401-0000-0000-C000-000000000046}\")\n \"Crisp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\")\n \"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\INPROCSERVER32\")\n \"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\LOCALSERVER\")\n \"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\LOCALSERVER\")\n \"Crisp.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"EXEMessenger_net40.exe\" queried SystemProcessInformation at 00000000-00001628-00000C15-1698777791 [PID: 1628]\n \"EXEMessenger_net40.exe\" queried SystemProcessInformation at 00000000-00001628-00000C15-1698786230 [PID: 1628]\n \"EXEMessenger_net40.exe\" queried SystemProcessInformation at 00000000-00001628-00000C15-1698965710 [PID: 1628]\n \"EXEMessenger_net40.exe\" queried SystemProcessInformation at 00000000-00001628-00000C15-1698975493 [PID: 1628]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00004384-00000C15-1728369720 [PID: 4384]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00004384-00000C15-1728377185 [PID: 4384]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00004384-00000C15-1728572224 [PID: 4384]\n \"Crisp.exe\" queried SystemProcessInformation at 00000000-00004384-00000C15-1728580582 [PID: 4384]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004384-25950-54-00C9E52F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004384-25950-458-00C98CD8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004384-25950-579-00C990EA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004384-25950-1070-00C99238","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\ProgramData\\winrepository_v2_0\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004376.00000000.172650.0FFF0000.00000004.mdmp, 00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99822","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Tries to steal Crypto currency wallets information (file access)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$33","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000001.174570.17500000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$34","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Crisp.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"EXEMessenger_net40.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"28b92c.rbs\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00004384.00000001.176477.00C91000.00000020.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00004384.00000001.176477.00C91000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"$38","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001628.00000001.176073.03CE0000.00000004.mdmp, 00000000-00001628.00000002.177992.03CE0000.00000004.mdmp\")\n Found reference to API \"WMRSendMessageString\" (Indicator: \"sendmessage\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"WMRSendMessageString\" (Indicator: \"sendmessage\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"EXEMessenger_net40.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001628)\n \"EXEMessenger_net40.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"EXEMessenger_net40.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"EXEMessenger_net40.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"EXEMessenger_net40.exe\" called \"IsWow64Process\" with parameter \"1628\" - (UID: 00000000-00001628)\n \"Crisp.exe\" called \"IsWow64Process\" with parameter \"4384\" - (UID: 00000000-00004384)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004384-25950-307-00C940B8\n FindFirstFileExW@KERNEL32.DLL at 00000000-00004384-25950-653-00CA5C99","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004384-25950-591-00C992FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004384-25950-591-00C992FA\n GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004384-25950-412-00CA2A1D\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004384-25950-418-00CA260E\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-424-00CA29B3\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004384-25950-445-00CA8CBB\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004384-25950-446-00CA85FB\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004384-25950-447-00CA86E1\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-449-00CA8AE7\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004384-25950-450-00CA8646\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-784-00CA8554\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-787-00CA8770\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-788-00CA8BEE\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004384-25950-789-00CA89C0\n GetLocaleInfoEx@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Celerity-Monitor.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Celerity-Monitor.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Crisp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.39EA0000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"87118102990,1516,105,,GetForegroundWindow,user32.dll,\"00:46:00.593\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001628.00000002.177992.03D1F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00004384-25950-1075-00CA33B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00001628.00000001.176073.05B0B000.00000004.mdmp\n 00000000-00001628.00000001.176073.06581000.00000004.mdmp\n 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\n Observed string: \"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00004376.00000001.174570.16C80000.00000004.mdmp\n 00000000-00004376.00000001.174570.17040000.00000004.mdmp\n 00000000-00004376.00000001.174570.17220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Celerity-Monitor.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"EXEMessenger_net40.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Crisp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CRISP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Celerity-Monitor.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"EXEMessenger_net40.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Crisp.exe\")\n file/memory contains long string(File: \"EXEMessenger_net40.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"EXEMessenger_net40.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"EXEMessenger_net40.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Dujixuqo (UID: 00000000-00001628)\n \"EXEMessenger_net40.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Dujixuqo\\Gowoyo (UID: 00000000-00001628)\n \"EXEMessenger_net40.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Dujixuqo\\aprooorfi (UID: 00000000-00001628)\n \"EXEMessenger_net40.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\eesWlJ (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"91.84.123.231:3333\"\n \"91.84.123.231:3334\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004384-25950-359-00C98849","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004384-25950-43-00CA2770\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004384-25950-365-00C9CE2E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4c","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$4d","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"_@t.ycb\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"EXEMessenger_net40.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72430000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 48150000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 47BA0000\n \"Celerity-Monitor.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 48150000\n \"EXEMessenger_net40.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F20000\n \"EXEMessenger_net40.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72900000\n \"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F20000\n \"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72900000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 1B660000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4B430000\n \"Celerity-Monitor.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4B430000\n \"EXEMessenger_net40.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76FA0000\n \"Crisp.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$50","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$51","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005812)\n Spawned process \"Celerity-Monitor.exe\" (UID: 00000000-00005684)\n Spawned process \"Celerity-Monitor.exe\" (UID: 00000000-00004376)\n Spawned process \"EXEMessenger_net40.exe\" (UID: 00000000-00001628)\n Spawned process \"Crisp.exe\" (UID: 00000000-00004384)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005812)\n Spawned process \"Celerity-Monitor.exe\" (UID: 00000000-00005684)\n Spawned process \"Celerity-Monitor.exe\" (UID: 00000000-00004376)\n Spawned process \"EXEMessenger_net40.exe\" (UID: 00000000-00001628)\n Spawned process \"Crisp.exe\" (UID: 00000000-00004384)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Crisp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"EXEMessenger_net40.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Celerity-Monitor.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7C464AE.tmp\"\n \"Celerity-Monitor.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EXEMessenger_net40.exe\"\n \"Crisp.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\82390C.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"__vcrt_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000000.172650.464D5000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"7C464AE.tmp\" has type \"data\" - Location: [%TEMP%\\7C464AE.tmp]\n \"filter-config.tmp\" has type \"data\" - Location: [%LOCALAPPDATA%\\Broadway\\filter-config.tmp]\n \"MSIBE4C.tmp\" has type \"data\"\n \"82390C.tmp\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID desktop-fvvf82a Archive ctime=Fri Apr 24 17:08:48 2026 atime=Fri Apr 24 17:08:48 2026 mtime=Tue Apr 14 02:05:52 2026 length=4766064 window=normal IDListSize 0x0173 Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\" LocalBasePath \"C:\\ProgramData\\winrepository_v2_0\\Celerity-Monitor.exe\"\" - Location: [%TEMP%\\82390C.tmp]\n \"filter-config.tmp\" has type \"data\" - Location: [%ALLUSERSPROFILE%\\winrepository_v2_0\\filter-config.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$58","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"EXEMessenger_net40.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EXEMessenger_net40.exe\" (UID: 1628)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\filter-config.tmp\"\n \"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\context-prime.lock\"\n \"Celerity-Monitor.exe\" reads file \"c:\\windows\\system32\\ntdll.dll\"\n \"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\celerity-monitor.exe\"\n \"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\msvcp140.dll\"\n \"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\protobuflite.dll\"\n \"Celerity-Monitor.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\sciter-x.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\sciter-x.dll\"\n \"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\ProtobufLite.dll\"\n \"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\MSVCP140.dll\"\n \"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\vcruntime140_1.dll\"\n \"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\VCRUNTIME140.dll\"\n \"Celerity-Monitor.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Broadway\\WINMM.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Crisp.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Crisp.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"Crisp.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\EXT_GATEWAY_TEST.LNK\"\n \"Crisp.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\EXT_GATEWAY_TEST.LNK\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Celerity-Monitor.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\sciter-x.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\protobuflite.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\vcruntime140_1.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\msvcp140.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\broadway\\vcruntime140.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\programdata\\winrepository_v2_0\\celerity-monitor.exe\"\n \"Celerity-Monitor.exe\" writes file \"c:\\programdata\\winrepository_v2_0\\filter-config.tmp\"\n \"Celerity-Monitor.exe\" writes file \"c:\\programdata\\winrepository_v2_0\\msvcp140.dll\"\n \"Celerity-Monitor.exe\" writes file \"c:\\programdata\\winrepository_v2_0\\protobuflite.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"WiX Toolset (4.0.0.0)\"\n \"91.84.123.231\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00005684\"\n YARA signature for PEB traversal process \"00000000-00004376\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$60","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"EXEMessenger_net40.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Crisp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"EXEMessenger_net40.exe\" called \"GetComputerNameW\" (UID: 00000000-00001628)\n \"Crisp.exe\" called \"GetComputerNameW\" (UID: 00000000-00004384)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"EXEMessenger_net40.exe\" called \"GetUserNameW\" (UID: 00000000-00001628)\n \"EXEMessenger_net40.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"filter-config.tmp\")\n Found string \"The Diffie-Hellman group is not compatible with the policy type.\" (Indicator: \"diffie-hellman\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found string \"The Diffie-Hellman group is not compatible with the policy type.\" (Indicator: \"diffie-hellman\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000001.174570.39375000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004376.00000000.172650.40E34000.00000002.mdmp, 00000000-00004376.00000002.176233.1B566000.00000002.mdmp, 00000000-00004376.00000002.176233.C888C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001628.00000000.174328.00DC8000.00000002.mdmp, 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp\")\n Found reference to API \"NtGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"NtGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\QHSafeMain.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00001628.00000000.174328.00DC8000.00000002.mdmp\n 00000000-00001628.00000001.176073.00DC8000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00001628.00000001.176073.03D1F000.00000004.mdmp, 00000000-00001628.00000002.177992.03D1F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"00000000-00001628.00000001.176073.05B0B000.00000004.mdmp, 00000000-00001628.00000001.176073.06581000.00000004.mdmp, 00000000-00001628.00000002.177992.060A0000.00000004.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"00000000-00004376.00000001.174570.16C80000.00000004.mdmp, 00000000-00004376.00000001.174570.17040000.00000004.mdmp, 00000000-00004376.00000001.174570.17220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$76","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,smss.exe,services.exe,lsass.exe,wininit.exe\" (Source: \"00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"EXEMessenger_net40.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\EXEMessenger_net40.exe]- [targetUID: 00000000-00001628]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"7C464AE.tmp has high entropy\"\n \"context-prime.lock has high entropy\"\n \"Dekafe has high entropy\"\n \"Zoceq has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$79","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"EXEMessenger_net40.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Crisp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"EXEMessenger_net40.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"b043d003f4eeb600\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}\n \"EXEMessenger_net40.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"f83fd00300000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%ALLUSERSPROFILE%\\winrepository_v2_0\\Celerity-Monitor.exe\" has high entropy 7.32382\n Dropped file \"%TEMP%\\7C464AE.tmp\" has high entropy 7.99992\n Dropped file \"%ALLUSERSPROFILE%\\winrepository_v2_0\\context-prime.lock\" has high entropy 7.9697\n Dropped file \"%ALLUSERSPROFILE%\\Dujixuqo\\Dekafe\" has high entropy 7.96938\n Dropped file \"%ALLUSERSPROFILE%\\Dujixuqo\\Zoceq\" has high entropy 7.93572\n Dropped file \"%LOCALAPPDATA%\\Broadway\\Celerity-Monitor.exe\" has high entropy 7.32382\n Dropped file \"%LOCALAPPDATA%\\Broadway\\context-prime.lock\" has high entropy 7.9697","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"EXEMessenger_net40.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"91.84.123.231\"\n \"pServiceName\": \"3333\"\n \"pHints\": \"3d45df8\"\n \"ppResult\": \"xI\"}\n \"EXEMessenger_net40.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"91.84.123.231\"\n \"pServiceName\": \"3334\"\n \"pHints\": \"3d407f8\"\n \"ppResult\": \"904ad40347000000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00004384-25950-21-00C98F26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00004384-25950-158-00C9F949\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004384-25950-167-00C9F905\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004384-25950-287-00C944D1\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004384-25950-480-00C94072\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004384-25950-842-00C9868F\n GetModuleHandleW@KERNEL32.DLL at 00000000-00004384-25950-1067-00C97D3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00004384-25950-587-00C99205\n GetStartupInfoW@KERNEL32.DLL at 00000000-00004384-25950-747-00CA4388","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Crisp.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$7a","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7b","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%TEMP%\\EXEMessenger_net40.exe\" connects to 91.84.123.231 on port 3333 (TCP)\n Process \"%TEMP%\\EXEMessenger_net40.exe\" connects to 91.84.123.231 on port 3334 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004376.00000001.174570.0FFF0000.00000004.mdmp, 00000000-00004376.00000001.174570.17500000.00000004.mdmp, 00000000-00004376.00000002.176233.0FFF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Celerity-Monitor.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7C464AE.tmp\" for deletion\n \"EXEMessenger_net40.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3fa2-f44a-eace-eb70.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Celerity-Monitor.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7C464AE.tmp\" with delete access\n \"EXEMessenger_net40.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3fa2-f44a-eace-eb70.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00004384-25950-53-00C9E726\n TerminateProcess@KERNEL32.DLL at 00000000-00004384-25950-157-00C9F8C4\n TerminateProcess@KERNEL32.DLL at 00000000-00004384-25950-458-00C98CD8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%LOCALAPPDATA%\\Broadway\\Celerity-Monitor.exe\" spawned likely due to injection\n Process \"%ALLUSERSPROFILE%\\winrepository_v2_0\\Celerity-Monitor.exe\" spawned likely due to injection\n Process \"%TEMP%\\EXEMessenger_net40.exe\" spawned likely due to injection\n Process \"%APPDATA%\\winrepository_v2_0\\Crisp.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\Celerity-Monitor.exe\"\n File type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\sciter-x.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\ProtobufLite.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\MSVCP140.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\VCRUNTIME140.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\winrepository_v2_0\\vcruntime140_1.dll\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 91.84.123.231 on port 3333\n TCP traffic to 91.84.123.231 on port 3334","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"EXEMessenger_net40.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BITCOIN\"\n \"EXEMessenger_net40.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\BITCOIN\"\n \"EXEMessenger_net40.exe\" opened file \"%APPDATA%\\BITCOIN\"\n \"EXEMessenger_net40.exe\" opened file \"%LOCALAPPDATA%\\BITCOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$7c","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"EXEMessenger_net40.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"EXEMessenger_net40.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"EXEMessenger_net40.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"EXEMessenger_net40.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"EXEMessenger_net40.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"EXEMessenger_net40.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$7d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":118,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69eb40d285237462ed027b10","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware","contacted_countries":["NLD"],"submit_name":"562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d.bin","analysis_start_time":"2026-04-24T10:07:51+00:00","indicators_count":{"informative":176,"suspicious":33,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.84.123.231","port":3333,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"address":"91.84.123.231","port":3334,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}],"processes":[{"pid":5804,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d.bin.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00005804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5812,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00005812","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5684,"ppid":5812,"name":"Celerity-Monitor.exe","command_line":"","sha256":"13a604c6a3347d36bcbfc702e6ac6b2421d4c33ae4f1c0e132439a7294739516","normalized_path":"%LOCALAPPDATA%\\Broadway\\Celerity-Monitor.exe","parent_uid":"00000000-00005812","uid":"00000000-00005684"},{"pid":4376,"ppid":5684,"name":"Celerity-Monitor.exe","command_line":"","sha256":"13a604c6a3347d36bcbfc702e6ac6b2421d4c33ae4f1c0e132439a7294739516","normalized_path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\Celerity-Monitor.exe","parent_uid":"00000000-00005684","uid":"00000000-00004376"},{"pid":1628,"ppid":4376,"name":"EXEMessenger_net40.exe","command_line":"","sha256":"f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669","normalized_path":"%TEMP%\\EXEMessenger_net40.exe","parent_uid":"00000000-00004376","uid":"00000000-00001628"},{"pid":4384,"ppid":4376,"name":"Crisp.exe","command_line":"","sha256":"c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a","normalized_path":"%APPDATA%\\winrepository_v2_0\\Crisp.exe","parent_uid":"00000000-00004376","uid":"00000000-00004384"}],"all_imported_dlls":["aepic.dll","SHCore.dll","kernel.appcore.dll","crypt32.dll","winmmbase.dll","ktmw32.dll","bcryptprimitives.dll","ntmarta.dll","ntshrui.dll","sfc.dll","cryptbase.dll","srvcli.dll","AcLayers.dll","msvcp_win.dll","coml2.dll","CoreUIComponents.dll","kernel32.dll","combase.dll","propsys.dll","KernelBase.dll","imm32.dll","cscapi.dll","rpcrt4.dll","WinTypes.dll","sspicli.dll","shell32.dll","CoreMessaging.dll","ws2_32.dll","sechost.dll","mscoree.dll","mswsock.dll","msvcrt.dll","uxtheme.dll","wkscli.dll","spp.dll","msctf.dll","clbcatq.dll","rasapi32.dll","fltLib.dll","wbemprox.dll","wbemsvc.dll","rsaenh.dll","sfc_os.dll","srclient.dll","userenv.dll","ncrypt.dll","ntasn1.dll","win32u.dll","IPHLPAPI.DLL","windows.storage.dll","TextInputFramework.dll","iertutil.dll","oleaut32.dll","netutils.dll","wmp.dll","VxSSL32.dll","cryptsp.dll","bcrypt.dll","clr.dll","VCRUNTIME140.dll","ntdll.dll","apphelp.dll","gdi32full.dll","msi.dll","msasn1.dll","comdlg32.dll","imagehlp.dll","wininet.dll","version.dll","vssapi.dll","comctl32.dll","mscoreei.dll","msihnd.dll","sciter-x.dll","tapisrv.dll","ole32.dll","netapi32.dll","wldp.dll","ProtobufLite.dll","wbemcomn.dll","gdi32.dll","ucrtbase.dll","mpr.dll","urlmon.dll","rasman.dll","secur32.dll","credui.dll","cfgmgr32.dll","vsstrace.dll","fusion.dll","MSVCP140.dll","BitsProxy.dll","shlwapi.dll","profapi.dll","dwmapi.dll","vcruntime140_clr0400.dll","RstrtMgr.dll","setupapi.dll","cabinet.dll","psapi.dll","ucrtbase_clr0400.dll","linkinfo.dll","winmm.dll","wow64win.dll","wow64cpu.dll","user32.dll","wow64.dll","amsi.dll","advapi32.dll","powrprof.dll","srpapi.dll","wintrust.dll","pcacli.dll","vcruntime140_1.dll","cldapi.dll","oleacc.dll","GdiPlus.dll","fastprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Crisp.exe","sha256":"c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"MSVCP140.dll","sha256":"96aeb5d343809615899c2ea97420d68df7705be35b9dd6e610bf2112f159092d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"VCRUNTIME140.dll","sha256":"5bcbf85f4fcd97ff3e7efa7b6766060c4f3d7747ebe91a7a5ea575410e3de860","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"vcruntime140_1.dll","sha256":"e30b3f4979b63b50438d061858c9cde962f4494e585c627a11c98b6c5b7b2592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"Celerity-Monitor.exe","sha256":"13a604c6a3347d36bcbfc702e6ac6b2421d4c33ae4f1c0e132439a7294739516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"ProtobufLite.dll","sha256":"47e77311d449819e2314c089e2da7de1efa0504f433fa58f8b80e697ea676008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"sciter-x.dll","sha256":"aa665a125618d9cd2980a4c1353b2117f9a4820781674d7969b0e08025f6b06b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"EXEMessenger_net40.exe","sha256":"f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"28b92b.msi","sha256":"045c6a60f34871f1473576c1595e9d5f1e73ed7d0f6fce44c5573ae664f7d953","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"28b92d.msi","sha256":"045c6a60f34871f1473576c1595e9d5f1e73ed7d0f6fce44c5573ae664f7d953","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"Dekafe","sha256":"7de070cd8de3a75003476c780f2e852a94899df60be30d2cb092e6a4c08c16ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"Zoceq","sha256":"60219e77e2653ad520d37717dc8b9a1da20b4fc54f54c8e06b2183bcc7e004b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"context-prime.lock","sha256":"c1b15510d114067d5df679f79f383df3a9772dc56a83b5bce7db33da96047fe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"filter-config.tmp","sha256":"ba1a689cb69e2a74f84b2e365fda958cd2ac0a33e8c422908a753b0cd746dad8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"name":"7C464AE.tmp","sha256":"faba7ed3ba66eda13826525d062079963bc034162e32d3e14e422e8b435d40b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Broadway\\filter-config.tmp","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\Celerity-Monitor.exe","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\filter-config.tmp","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\MSVCP140.dll","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\ProtobufLite.dll","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\sciter-x.dll","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\winrepository_v2_0\\context-prime.lock","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%TEMP%\\7C464AE.tmp","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%APPDATA%\\winrepository_v2_0\\Crisp.exe","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%TEMP%\\EXEMessenger_net40.exe","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\Dujixuqo\\Setavuv","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%TEMP%\\3fa2-f44a-eace-eb70.tmp","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\Dujixuqo\\Dekafe","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%ALLUSERSPROFILE%\\Dujixuqo\\Zoceq","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%TEMP%\\82390C.tmp","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69eb40d285237462ed027b10"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69eb40d285237462ed027b10"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TR/Malware Sample 562d8f8381ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 562d8f8381ad…. Malware family: TR/Malware. Threat score 100/100. 1/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d"}],["$","meta","4",{"property":"og:title","content":"Malicious TR/Malware Sample 562d8f8381ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 562d8f8381ad…. Malware family: TR/Malware. Threat score 100/100. 1/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TR/Malware Sample 562d8f8381ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 562d8f8381ad…. Malware family: TR/Malware. Threat score 100/100. 1/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L7e","11",{}]]