26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] ab:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_60% Sample 57748e42e68e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 57748e42e68e…. Malware family: Win/grayware_confidence_60%. Threat score 100/100. 1/27 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed","keywords":["Malicious","Win/grayware_confidence_60%","malware analysis","sandbox report","threat intelligence","57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed"],"about":{"@type":"SoftwareApplication","name":"57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin","applicationCategory":["peexe","executable"],"identifier":"57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_60%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T63f,Found string "Not enough buffer size for data decompression" (Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Not enough buffer size for data compression" (Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Zlib compression failed in Tight encoder" (Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Error while processing content unencoding: Unknown failure within decompression software." (Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "--no-upload-gzip don't use gzip compression when uploading" (Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found string ".?AVSevenZipArchive@SevenZip@@" (Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found string "The specified compression format is unsupported." (Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "The compression operation could not be completed because a transaction is active on the file." (Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "CLRCOM~1.DLLclrcompression.dll" (Source: "00000000-00003592.00000001.172450.16082000.00000004.mdmp")28:T159a,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "@System@FreeMemory$qpv" (Indicator: "FreeMemory"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")29:T12b4,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")2a:T48f,Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")2b:T18e1,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "Check failed: WaitForSingleObject(semaphore_, INFINITE) == WAIT_OBJECT_0" (Indicator: "WaitForSingleObject"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp")2c:T91e,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")2d:Tbaa,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "@Sysutils@SafeLoadLibrary$qqrx20System@UnicodeStringui" (Indicator: "LoadLibrary"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")2e:T4a9,Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "ZwSetValueKey" (Indicator: "ZwSetValueKey"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")2f:T989,Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")30:Tdbd,Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "RC2a" (Indicator: "RC2"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "%s4-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s" (Indicator: "HMAC"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to ".?AVCBaseCoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to ".?AVCDecoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to ".?AVCAesCbcCoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to ".?AUCAesCbcDecoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to ".?AUCAesCbcEncoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to ".?AVCEncoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")31:T7e6,Found PE header "MZ" - Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000001.172450.02F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000001.172450.05F40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000002.174371.02F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000002.174371.049D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005176.00000001.169796.00512000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005588.00000001.172670.055F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005588.00000001.172670.05609000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005588.00000001.172670.05BB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005996.00000000.169777.04D60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005996.00000000.169777.0B5E7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000000.169921.04F80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000000.169921.0C363000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000001.171842.04F80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000002.172520.031F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000002.172520.04F80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000002.172520.0B7C9000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000002.172520.0BE6F000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007640.00000002.172520.0C200000.00000004.mdmp")32:T735,"XenController.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "XenController.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "XenController.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "XenController.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "XenController.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "XenController.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "XenController.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "XenController.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "XenController.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "XenController.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "XenController.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "XenController.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "XenController.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "XenController.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32")33:T68e," %d, connected=%d" (Indicator: " connect "; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "Failed to connect to %s port %u after %lld ms: %s" (Indicator: " connect "; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "query connect reply: %dms" (Indicator: " connect "; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp")7b:T51d,Observed email domain:"imap." [Source: 00000000-00003592.00000001.172450.00B40000.00000002.mdmp] Observed email domain:"smtp." [Source: 00000000-00003592.00000001.172450.00B40000.00000002.mdmp] Observed email domain:"pop3." [Source: 00000000-00003592.00000001.172450.00B40000.00000002.mdmp] Observed email domain:"n-us.mail.config" [Source: 00000000-00003592.00000001.172450.02F20000.00000004.mdmp] Observed email domain:":\program files\windowsapps\sharedlimitedtime\infusedapps\packages\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\models\it-it.mail.config" [Source: 00000000-00003592.00000001.172450.14CE0000.00000004.mdmp] Observed email domain:"n-gb.mail.config" [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp] Observed email domain:"en-us.mail.config" [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp] Observed email domain:"es-es.mail.config" [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp] Observed email domain:"r-fr.mail.config" [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp] Observed email domain:"ffice.ui.xaml.hx.mail.dll" [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp] Observed email domain:"dmx." [Source: 00000000-00003592.00000001.172450.16082000.00000004.mdmp]7c:T1b83,Pattern match: "http://schemas.microsoft.com/smi/2" Heuristic match: ";#.ly" Heuristic match: "'g.zw" Heuristic match: ">/.dm" Heuristic match: "bf.kw" Heuristic match: "m .lc" Heuristic match: "x.4.fk" Heuristic match: "w=.ai" Heuristic match: "z1t.pm" Heuristic match: "@o.bv" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0" Pattern match: "www.madshi.net00*020:0b0j0r0z0b0j0r0z011*121:1b1j1r1z1b1j1r1z12'212" Pattern match: "www.msn.commuidbv10qyc~/m9uwww.msn.commsfpcv10i/t7''g" Pattern match: "http://schemas.microsoft.com/smi/2005/windo" Heuristic match: "command.com" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Pattern match: "https://curl.se/docs/http-cookies.html" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html" Heuristic match: ".onion" Pattern match: "http://example.com" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "../../handler/handler_main.cc" Heuristic match: "../../handler/win/crash_report_exception_handler.cc" Heuristic match: "../../handler/user_stream_data_source.cc" Heuristic match: "../../handler/crash_report_upload_thread.cc" Heuristic match: "../../handler/minidump_to_upload_parameters.cc" Heuristic match: "../../util/win/initial_client_data.cc" Heuristic match: "../../util/misc/paths_win.cc" Heuristic match: "../../util/win/exception_handler_server.cc" Heuristic match: "../../util/win/session_end_watcher.cc" Heuristic match: "../../util/file/file_reader.cc" Heuristic match: "../../util/win/scoped_process_suspend.cc" Heuristic match: "../../util/file/file_seeker.cc" Heuristic match: "../../util/win/registration_protocol_win.cc" Heuristic match: "../../util/win/scoped_handle.cc" Heuristic match: "../../util/file/file_io.cc" Heuristic match: "../../util/win/scoped_set_event.cc" Heuristic match: "../../util/thread/thread_win.cc" Heuristic match: "../../util/synchronization/semaphore_win.cc" Heuristic match: "../../util/file/file_io_win.cc" Heuristic match: "../../util/win/scoped_local_alloc.cc" Heuristic match: "../../client/crash_report_database_win.cc" Heuristic match: "../../client/settings.cc" Heuristic match: "../../client/crash_report_database.cc" Heuristic match: "../../snapshot/win/process_snapshot_win.cc" Heuristic match: "../../snapshot/minidump/process_snapshot_minidump.cc" Heuristic match: "../../snapshot/win/exception_snapshot_win.cc" Heuristic match: "../../snapshot/win/module_snapshot_win.cc" Heuristic match: "../../snapshot/win/system_snapshot_win.cc" Heuristic match: "../../snapshot/memory_snapshot.cc" Heuristic match: "../../snapshot/win/process_reader_win.cc" Heuristic match: "../../snapshot/minidump/system_snapshot_minidump.cc" Heuristic match: "../../snapshot/minidump/minidump_simple_string_dictionary_reader.cc" Heuristic match: "../../snapshot/minidump/module_snapshot_minidump.cc" Heuristic match: "../../snapshot/capture_memory.cc" Heuristic match: "../../snapshot/win/cpu_context_win.cc" Heuristic match: "../../snapshot/win/pe_image_reader.cc" Heuristic match: "../../snapshot/crashpad_types/crashpad_info_reader.cc" Heuristic match: "../../snapshot/win/pe_image_annotations_reader.cc" Heuristic match: "../../snapshot/minidump/minidump_string_list_reader.cc" Heuristic match: "../../snapshot/minidump/minidump_annotation_reader.cc" Heuristic match: "../../snapshot/win/process_subrange_reader.cc" Heuristic match: "../../snapshot/win/pe_image_resource_reader.cc" Heuristic match: "../../snapshot/cpu_context.cc" Heuristic match: "../../util/net/http_transport_win.cc" Heuristic match: "../../util/net/http_multipart_builder.cc" Heuristic match: "../../util/net/http_body_gzip.cc" Heuristic match: "../../client/prune_crash_reports.cc" Heuristic match: "../../client/crashpad_client_win.cc" Heuristic match: "../../minidump/minidump_file_writer.cc" Heuristic match: "../../minidump/minidump_module_writer.cc" Heuristic match: "../../minidump/minidump_memory_writer.cc" Heuristic match: "../../minidump/minidump_writer_util.cc" Heuristic match: "../../minidump/minidump_writable.cc" Heuristic match: "../../minidump/minidump_system_info_writer.cc" Heuristic match: "../../minidump/minidump_thread_writer.cc" Heuristic match: "../../minidump/minidump_exception_writer.cc" Heuristic match: "../../minidump/minidump_unloaded_module_writer.cc" Heuristic match: "../../minidump/minidump_context_writer.cc" Heuristic match: "../../minidump/minidump_module_crashpad_info_writer.cc" Heuristic match: "../../third_party/mini_chromium/mini_chromium/base/rand_util.cc" Heuristic match: "../../util/file/filesystem_win.cc" Heuristic match: "../../util/file/file_writer.cc" Heuristic match: "../../util/file/directory_reader_win.cc" Heuristic match: "../../util/win/process_info.cc" Heuristic match: "../../util/process/process_memory_win.cc" Heuristic match: "../../util/process/process_memory.cc" Heuristic match: "../../util/process/process_memory_range.cc" Heuristic match: "../../util/win/module_version.cc" Heuristic match: "../../util/win/critical_section_with_debug_info.cc" Heuristic match: "ale-100_8wekyb3d8bbwe\assets\secondarytiles\directions\work\ltr\contrast-black\smalltile.sc" Pattern match: "http://go.microsoft.com/fwlink/?linkid=228610" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851152" Pattern match: "https://go.microsoft.com/fwlink/?linkid=852747" Heuristic match: "h`b.kp" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://developers.facebook.com/policy/" Heuristic match: "50.png.pn" Heuristic match: "micros~2.0_nmicrosoft.microsoftofficehub_2015.7608.23501.0_neutral_~_8wekyb3d8bbwe.pn" Heuristic match: "pagesp~2efampagespanel.pn"7d:T33c9,Found URL "https://http://error:" - Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found URL "http://example.comcryptunprotectmemorycryptprotectmemorysrandgetusernamewrandadvapi32.dllinclude_regexexclude_regexinclude_filterexclude_filterfilesheightratemonitorswidthwindowcomputeruseriverjpegjpeg_widthbuildidjpeg_heighthashesldrshutdownthreadntcreatethreadexntworkerfactoryworkerreadytunnelportdataportnonecontrolportiostreamfalsebad" - Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp") Found URL "http://developers.facebook.com/policy/]." - Source: "00000000-00003592.00000001.172450.15FC2000.00000004.mdmp") Found URL "http://developers.facebook.com/policy/]." - Source: "00000000-00003592.00000001.172450.16082000.00000004.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found URL "https://mathiasbynens.be/>permission" - Source: "00000000-00003592.00000002.174371.02F20000.00000004.mdmp") Found URL "http://www.zzz.org/mailman/listinfo/ppp--192.168.1.2.889.32614.987812255.500.21814--end" - Source: "00000000-00003592.00000002.174371.02F20000.00000004.mdmp") Found URL "https://mathiasbynens.be/>permission" - Source: "00000000-00003592.00000002.174371.14CE0000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/tree/master/adodbapi." - Source: "00000000-00003592.00000002.174371.15FC2000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issuesthis" - Source: "00000000-00003592.00000002.174371.15FC2000.00000004.mdmp") Found URL "http://www.linux.org.uk/mailman/listinfo/linuxuser>,list-id:" - Source: "00000000-00003592.00000002.174371.16082000.00000004.mdmp") Found URL "http://www.linux.org.uk/mailman/listinfo/linuxuser>,list-archive:" - Source: "00000000-00003592.00000002.174371.16082000.00000004.mdmp") Found URL "http://www.linux.org.uk/pipermaiguxuser/>date:" - Source: "00000000-00003592.00000002.174371.16082000.00000004.mdmp") Found URL "http://www.socal-raves.org/--boundary_(id_pgs2f2a+z+/jl7hupkgrha)--zzrsz1bvmww3en2nkupvkyupn5/vrfohrd0vyzoqhkilu6txyhjxmpuiloawc1bpmhepazyzorhnlxujm07hatwhr8mjyqkwwr8/fq82henperozg3ulhhr9lagtvekcg5znruuvlebpazadhg0zgkypmdotokzvimygocpukkqqcbjaws0ileq2rojdh6a+md1qwdbrsx7isygfrttrmbpjioiexjihfjimgir9fjon8imsfxyhspn4oosa2msaj4n+8bmg03fbjzopojgsvzrxu1oomrpxyyjdqjihfaeozpxbreanujori6cibfinq4ngukh/wqd/h5ofycz0hjxr62opzfaat0ifizo4diiuojkjeqkiuozirko5y1a7awckgabkuyod5lpdk6eus6ckdqpetwl1eqpfhjpvekpvl6eguaads=--boundary----outer--les:" - Source: "00000000-00003592.00000002.174371.16082000.00000004.mdmp") Found URL "http://tix.sourceforge.neteither" - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://tix.sourceforge.net/tide." - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://tix.sourceforge.net,wmdefault" - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://tix.sourceforge.net.python______if" - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://tix.sourceforge.netwith" - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://developers.facebook.com/policy/]." - Source: "00000000-00003592.00000002.174371.1610C000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigning-g1.crl03-http://crl4.digicert.com/evcodesigning-g1.crl0kd0b070*0(https://www.digicert.com/cps0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertevcodesigningca.crt0c?3zkll'diukck*hdigicert" - Source: "00000000-00005176.00000000.169618.00F8E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0.http://www.digicert.com/ssl-cps-repository.htm0*a]o8" - Source: "00000000-00005176.00000000.169618.00F8E000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00005176.00000000.169618.00F8E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00005176.00000000.169618.00F8E000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0(https://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp")91:Ta82,Found string "Ping failed; helper seems to have died." (Indicator: "ping"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found string "Bad hostname" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Hostname in DNS cache doesn't have needed family, zapped" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "Hostname '%s' was found" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "aws-sigv4: service too long in hostname" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "aws-sigv4: region too long in hostname" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "route" (Indicator: "route"; Source: "00000000-00003592.00000001.172450.15EF5000.00000004.mdmp, 00000000-00003592.00000002.174371.15EF5000.00000004.mdmp")92:T778,Found registry deletion API: "RegDeleteValueW" in file "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin" Found registry deletion API: "RegDeleteKeyW" in file "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin" Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00005176.00000001.169796.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00005176.00000001.169796.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00005176.00000001.169796.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00005176.00000001.169796.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA" in file "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin" Found registry deletion API: "NtDeleteKey" in "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp"93:T787,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003592-00000C2C-1650147098") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found string "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")94:Ta0d,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")95:T623,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")96:T664,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")97:T58e,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp")98:T13d2,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00005176.00000001.169796.00401000.00000020.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp") Found reference to API "could not DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "could not RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "could not ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003592.00000001.172450.00B40000.00000002.mdmp") Found reference to API "Check failed: RevertToSelf()" (Indicator: "RevertToSelf"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")99:T863,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00005588.00000000.172512.00D91000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003592.00000000.170686.003AD000.00000002.mdmp, 00000000-00003592.00000001.172450.00B40000.00000002.mdmp, 00000000-00003592.00000001.172450.00BB7000.00000004.mdmp, 00000000-00003592.00000002.174371.003AD000.00000002.mdmp, 00000000-00003592.00000002.174371.00BB7000.00000004.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003592.00000001.172450.05875000.00000004.mdmp, 00000000-00003592.00000002.174371.04F5D000.00000004.mdmp")9a:Te98,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Scan.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Scan.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Scan.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Scan.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Scan.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Scan.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: XenController.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: XenController.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: XenController.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: datastate.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: madExcept_.bpl] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: madExcept_.bpl] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: madExcept_.bpl] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: madExcept_.bpl] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: madExcept_.bpl] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: madExcept_.bpl]9b:Td79," Microsoft Corporation" "XenController.exe" was detected as "VC8 -> Microsoft Corporation" "sdassist.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "HardwareLib.dll" was detected as "Borland Delphi 3.0 (???)" "Temperature.dll" was detected as "Borland Delphi 3.0 (???)" "PluginHelper.dll" was detected as "Borland Delphi 3.0 (???)" "dataexchange.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "datastate.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "PowerMgr.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "vcl120.bpl" was detected as "Morphine v1.2 (DLL)" "rtl120.bpl" was detected as "Morphine v1.2 (DLL)" "madExcept_.bpl" was detected as "Morphine v1.2 (DLL)" "vclx120.bpl" was detected as "Borland Component" "madBasic_.bpl" was detected as "Morphine v1.2 (DLL)" "madDisAsm_.bpl" was detected as "tElock v1.0 (private) -> tE!"a2:T1dbd,"CobSu43.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\CobSu43.exe]- [targetUID: 00000000-00005996] "libcrypto-1_1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\libcrypto-1_1.dll]- [targetUID: 00000000-00005996] "Register.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\Register.dll]- [targetUID: 00000000-00005996] "57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-JGM1E.tmp\57748e42e68e56c1f8813ed1c6a372191dfacc6488b4500f973a3aad93add2ed.bin.tmp]- [targetUID: 00000000-00006084] "Scan.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections"- Location: [%TEMP%\is-GU9OH.tmp\Scan.dll]- [targetUID: 00000000-00005996] "sqlite3.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections"- Location: [%TEMP%\is-GU9OH.tmp\sqlite3.dll]- [targetUID: 00000000-00005996] "libssl-1_1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00005996] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\NTObserver_v2_release\Crisp.exe]- [targetUID: 00000000-00005588] "XenController.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%USERPROFILE%\XenController.exe]- [targetUID: 00000000-00003592] "sdassist.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\sdassist.dll]- [targetUID: 00000000-00005996] "HardwareLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\HardwareLib.dll]- [targetUID: 00000000-00005996] "Temperature.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\Temperature.dll]- [targetUID: 00000000-00005996] "PluginHelper.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\PluginHelper.dll]- [targetUID: 00000000-00005996] "dataexchange.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\dataexchange.dll]- [targetUID: 00000000-00005996] "datastate.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\datastate.dll]- [targetUID: 00000000-00005996] "PowerMgr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\PowerMgr.dll]- [targetUID: 00000000-00005996] "vcl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\vcl120.bpl]- [targetUID: 00000000-00005996] "rtl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\rtl120.bpl]- [targetUID: 00000000-00005996] "madExcept_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\madExcept_.bpl]- [targetUID: 00000000-00005996] "vclx120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\vclx120.bpl]- [targetUID: 00000000-00005996] "madBasic_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\madBasic_.bpl]- [targetUID: 00000000-00005996] "madDisAsm_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\madDisAsm_.bpl]- [targetUID: 00000000-00005996] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005176] "CobSu43.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\CobSu43.exe]- [targetUID: 00000000-00005996] "libcrypto-1_1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\libcrypto-1_1.dll]- [targetUID: 00000000-00005996] "Register.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections"- Location: [%TEMP%\is-GU9OH.tmp\Register.dll]- [targetUID: 00000000-00005996] "Scan.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\Scan.dll]- [targetUID: 00000000-00005996] "sqlite3.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\sqlite3.dll]- [targetUID: 00000000-00005996] "libssl-1_1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\libssl-1_1.dll]- [targetUID: 00000000-00005996] "sdassist.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\sdassist.dll]- [targetUID: 00000000-00005996] "HardwareLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\is-GU9OH.tmp\HardwareLib.dll]- [targetUID: 00000000-00005996] "Temperature.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\Temperature.dll]- [targetUID: 00000000-00005996] "PluginHelper.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-GU9OH.tmp\PluginHelper.dll]- [targetUID: 00000000-00005996] "dataexchange.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%TEMP%\is-GU9OH.tmp\dataexchange.dll]- [targetUID: 00000000-00005996] "datastate.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\datastate.dll]- [targetUID: 00000000-00005996] "PowerMgr.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-GU9OH.tmp\PowerMgr.dll]- [targetUID: 00000000-00005996] "vcl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\vcl120.bpl]- [targetUID: 00000000-00005996] "rtl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\rtl120.bpl]- [targetUID: 00000000-00005996] "madExcept_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\is-GU9OH.tmp\madExcept_.bpl]- [targetUID: 00000000-00005996] "vclx120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\vclx120.bpl]- [targetUID: 00000000-00005996] "madBasic_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\madBasic_.bpl]- [targetUID: 00000000-00005996] "madDisAsm_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\NTObserver_v2_release\madDisAsm_.bpl]- [targetUID: 00000000-00005996]a3:Tc5c,"