24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 6d21d4492507… — Score 78/100 — Hybrid Analysis","description":"Malicious verdict for sample 6d21d4492507…. Malware family: Win/malicious_confidence_60%. Threat score 78/100. 5/27 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0"],"about":{"@type":"SoftwareApplication","name":"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0","additionalType":"Malicious sample"},"threatScore":78,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te4d,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "ClrVirtualAllocWithinRange request #%u for %08x bytes in [ %p .. %p ], query count was %u - returned %s: %p" (Indicator: "VirtualAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "H_VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dNtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dNtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dNtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "ClrVirtualAllocWithinRange request #%u for %08x bytes in [ %p .. %p ], query count was %u - returned %s: %p" (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|68_0" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")26:T91e,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dNtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|191_0" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")27:T13bf,Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "H_CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dCreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")28:T5a9,Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "UndoRevert/SetThreadToken failed for hToken = %d" (Indicator: "SetThreadToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcessToken"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "UndoRevert/SetThreadToken failed for hToken = %d" (Indicator: "SetThreadToken"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")29:T8a8,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dLoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|163_0" (Indicator: "LoadLibrary"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")2a:T499,Found reference to API "g____PInvoke|14_0" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "g____PInvoke|15_0" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "g____PInvoke|16_0" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "g____PInvoke|17_0" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "g____PInvoke|18_0" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API "RegSetValueExWTU" (Indicator: "RegSetValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp")2b:T1068,Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to "AssemblyNative_GetHashAlgorithm" (Indicator: "HashAlgorithm"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "AesEngine" (Indicator: "Aes"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to "rgument_InvalidOidValue" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to "rgument_PemEncoding_EncodedSizeTooLarge" (Indicator: "PemEncoding"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "rgument_PemEncoding_InvalidLabel" (Indicator: "PemEncoding"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "rgument_PemEncoding_NoPemFound7" (Indicator: "PemEncoding"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_ArgECDsaRequiresECDsaKey" (Indicator: "ECDsa"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to "ryptography_CertReq_MissingOidInCollection+" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_CngKeyWrongAlgorithm" (Indicator: "CngKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_CryptoStream_FlushFinalBlockTwicek" (Indicator: "CryptoStream"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_HashAlgorithmNameNullOrEmpty'" (Indicator: "HashAlgorithm"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_InvalidCurveOidx" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_InvalidHashAlgorithmOid" (Indicator: "HashAlgorithm"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_InvalidHashAlgorithmOid" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_Oid_InvalidName" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to "ryptography_Oid_InvalidValue#" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_Oid_SetOnceFriendlyName>" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_Oid_SetOnceValue" (Indicator: "Oid"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to "ryptography_RC2_EKS40#" (Indicator: "RC2"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_RC2_EKSKSU" (Indicator: "RC2"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to "ryptography_RC2_EKSKS2" (Indicator: "RC2"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp")2c:T44e,Found PE header "MZ" - Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000000.212594.36020000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000002.216437.347A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000002.216437.35FE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000003.221942.35FA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")2d:T1765,Found api reference ",CryptSetKeyParam failed with error code {0}." (Indicator: "CryptSetKeyParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found api reference "g____PInvoke|20_0" (Indicator: "BCryptDecrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|20_0" (Indicator: "CryptDecrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|30_0" (Indicator: "BCryptExportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|30_0" (Indicator: "CryptExportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|40_0" (Indicator: "CertGetValidUsages"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|80_0" (Indicator: "CryptDecodeObject"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|0_0" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|101_0" (Indicator: "CryptQueryObject"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|11_0" (Indicator: "CertControlStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|21_0" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|21_0" (Indicator: "CryptSetProvParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|41_0" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|1_0" (Indicator: "BCryptSetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|12_0" (Indicator: "CryptGenKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|22_0" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|22_0" (Indicator: "CryptSetProvParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|32_0" (Indicator: "NCryptOpenStorageProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|42_0" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|42_0" (Indicator: "BCryptGetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|52_0" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|92_0" (Indicator: "CryptMsgClose"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|13_0" (Indicator: "NCryptDeleteKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|23_0" (Indicator: "CryptGetProvParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|23_0" (Indicator: "CertFindExtension"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|33_0" (Indicator: "NCryptGetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found api reference "g____PInvoke|33_0" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp")2e:Tbe8,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200-00000C2C-2322250758") Found reference to API "g____PInvoke|20_0" (Indicator: "BCryptDecrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "g____PInvoke|52_0" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "g____PInvoke|48_0" (Indicator: "BCryptImportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "BCryptEncrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "g____PInvoke|49_0" (Indicator: "BCryptImportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptOpenAlgorithmProviderFlags" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp")2f:T215d,Assembly shows XOR instruction xor eax 01h in Stream UID: 17910-11978-00000001405C1F00 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12030-000000014059F1B0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12030-000000014059F1B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12030-000000014059F1B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12030-000000014059F1B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12032-000000014059D5B0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12032-000000014059D5B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12032-000000014059D5B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12032-000000014059D5B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12037-000000014059BA50 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12037-000000014059BA50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12037-000000014059BA50 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12037-000000014059BA50 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor rdi rsi in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor edi esi in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor rax rdi in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor eax edi in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12040-000000014059A370 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12063-000000014058A930 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12063-000000014058A930 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12063-000000014058A930 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12063-000000014058A930 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12064-0000000140589C50 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12064-0000000140589C50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12064-0000000140589C50 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12064-0000000140589C50 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12128-000000014056B610 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12128-000000014056B610 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12128-000000014056B610 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12128-000000014056B610 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12129-000000014056B570 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12129-000000014056B570 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12129-000000014056B570 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12129-000000014056B570 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12130-000000014056B4D0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12130-000000014056B4D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12130-000000014056B4D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12130-000000014056B4D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12147-00000001405675A0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12147-00000001405675A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12147-00000001405675A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12147-00000001405675A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12180-0000000140551F40 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12180-0000000140551F40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12180-0000000140551F40 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12180-0000000140551F40 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12189-000000014054B460 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12189-000000014054B460 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12189-000000014054B460 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12189-000000014054B460 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor rdx rax in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor edx eax in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12190-000000014054AA30 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12194-0000000140546560 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12194-0000000140546560 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12241-000000014052D150 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12241-000000014052D150 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-12266-0000000140515150 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-12266-0000000140515150 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-12266-0000000140515150 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-12266-0000000140515150 Assembly shows XOR instruction xor al 01h in Stream UID: 17910-12916-0000000140420FD0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13447-00000001403C0010 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13447-00000001403C0010 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13447-00000001403C0010 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13447-00000001403C0010 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13460-00000001403BD330 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13460-00000001403BD330 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13460-00000001403BD330 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13460-00000001403BD330 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13660-000000014039EE60 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13660-000000014039EE60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13660-000000014039EE60 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13660-000000014039EE60 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13667-000000014039D150 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13667-000000014039D150 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13667-000000014039D150 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13667-000000014039D150 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13668-000000014039E770 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13668-000000014039E770 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13668-000000014039E770 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13668-000000014039E770 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13669-00000001403A28D0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13669-00000001403A28D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13669-00000001403A28D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13669-00000001403A28D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 17910-13670-00000001403A27E0 Assembly shows XOR instruction xor eax esp in Stream UID: 17910-13670-00000001403A27E0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 17910-13670-00000001403A27E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 17910-13670-00000001403A27E030:Tb80,Found string "Private Key]" (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "Public Key]" (Indicator: "public key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "C PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "SA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "XObject contains only the public half of a key pair. A private key must also be provided." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "The issuer certificate public key algorithm ({0}) does not match the value for this certificate request ({1}), use the X509SignatureGenerator overload." (Indicator: "public key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "HThe provided issuer certificate does not have an associated private key." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "^The public key within the PKCS#10 Certification Request did not verify the embedded signature." (Indicator: "public key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "6The certificate already has an associated private key." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "Key is not a valid private key." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string ")Key is not a valid public or private key." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "\A certificate referenced a private key which was already referenced, or could not be loaded." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "DThe provided key does not match the public key for this certificate." (Indicator: "public key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "NThe provided key does not match the public key algorithm for this certificate." (Indicator: "public key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "HAdding a DSA private key to the store is not supported on this platform." (Indicator: "private key"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "Invalid assembly public key." (Indicator: "public key"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")31:T8f6f,Found XOR loop in file "sample.bin" at offset 280700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1857628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1980460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2846930; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6374330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6466552; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6477192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6493280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7568088; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7571508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7573703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8004788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8065268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8078192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8837083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9418768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9450042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9579340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9670781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9671019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9697361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9725390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9757553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9785086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9843288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9952281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9962900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10004669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10151202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10161586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10201188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10296209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10306967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10321771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10331407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10435048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10529230; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10541449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10557561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10660317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10902945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 11198489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 11227857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 11317543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 11355893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 11367398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 175383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 214423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 214455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 427898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 452091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 452102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 690380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 906818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 909824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 926003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 931088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 931101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 931114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 931522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 946375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 972073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 972102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1417651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1417765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1417895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1480749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1480892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1481013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1481077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1499954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1499964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1499991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1501854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1501864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1646713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1720753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2006567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2173449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2173456; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2453606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2866200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2869078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2907508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908443; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2908465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2922497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2922512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2922941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2922957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2923362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2923378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3473594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3476777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3480516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3482516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3483044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3484835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3501689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3502299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3502423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3965091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3965101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4125251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4126215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4136106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4309289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4719955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4733552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4948288; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5000899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5001186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5003881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5004316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5027791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5094016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5094023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5096663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5100761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5100768; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5101551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5101859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5101866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5102123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5103509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5105721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5109384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5109391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5111243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5117978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5117985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5144304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5376041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5702797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5761601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5761613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5865341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5868326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5897932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5898164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5898574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5899187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5899844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5903450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5905411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5908877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5908902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5908927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5908952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5908977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5909007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5911166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5911571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5912021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5912384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5913381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5913850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5914201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5916638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5917076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5917540; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5917887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5918869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5919338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5919692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5923009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5923536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5923884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5924549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5925055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5925914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5926257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5929773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5929793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5930140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5931851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5932198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5935942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5936531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5936909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5939331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5939703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5942194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5944753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5944778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5944803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5944828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5946839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5947140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5947395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952286; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5954231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5956975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5957449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5957934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5958288; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5958687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5959254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5960541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5968366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5973246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5978126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5983006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6039383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8231429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8235013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8239621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8243205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8770282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8773465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8777732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8778244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8794953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8795771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8795895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8854824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8857510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8934512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9043216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9177675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9709127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9795665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9826101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9852816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9926238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9946452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9973941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10006974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10006995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10016964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10023865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10094583; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10147206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10148134; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10148765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10157805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10233973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10263582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10268518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10289143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10292765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10323732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10359120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10405839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10479818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10622225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10730304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10767659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10947593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11002318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11025789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11077680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11119529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11183230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 12990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 53603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 150883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 186193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 240454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 280423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 478119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 523241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 591927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 774515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 831834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 992666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1153909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1159666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1262164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1284287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1295002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1309810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1318343; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1332162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1367147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1463685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1464937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1470872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1472432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1483462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1483496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1515981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1518359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1544880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1546877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1676466; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1803130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1828370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1839320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1839547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1839645; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1881488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2007928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2018423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2129686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2229734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2242064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2301517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2301608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2301675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2501215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2501302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2501367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2534623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2534706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2534767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2572551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2683247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2683334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2683399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2717363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2995394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3116039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3154939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3175559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3176098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3176168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3518966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3578173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3840375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3860631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3869784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3884709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3884717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3889218; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3928616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3954953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3973591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3978949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4108961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4109019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4109084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4110089; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4110417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4287785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4299124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4320017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4381371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4385953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4387217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4460528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4463061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4584496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4609335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4728056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4829471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4834020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5097202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5135329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5137184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5144554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5154208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5248670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5769715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6359030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6405360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6467439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6467911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6610408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6628332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6672331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6672947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7343584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7395920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7405776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7414183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7458393; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7458873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7502375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7526512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7547643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7567465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7602947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7603067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7607009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7607269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7634574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7647255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7718938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7732991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7734271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7738090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7738097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7741199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7782521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7967144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8011880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8127548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8146400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8173436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8690537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8974671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9082171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9439159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9444796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9545800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9596894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9600443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9705359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9771573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9892408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9897854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9908996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9931455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10173869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10209516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10409603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10455352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10585559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10692146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10918113; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11212008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11239367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11259815; code bytes = 803032:T70c,Found string "r = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='DiagTrackLogonFilter'" -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "$w = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='DiagTrackWatchFilter'" -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -match 'DiagTrackLogonFilter' -or $_.Filter -match 'DiagTrackWatchFilter' } | Remove-WmiObject -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackLogonConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackWatchConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackLogonFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackWatchFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp")33:T9d8,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GlobalizationNative_GetLocaleInfoGroupingSizes" (Indicator: "GetLocaleInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GlobalizationNative_GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GlobalizationNative_GetLocaleInfoString" (Indicator: "GetLocaleInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GlobalizationNative_GetLocaleInfoGroupingSizes" (Indicator: "GetLocaleInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GlobalizationNative_GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GlobalizationNative_GetLocaleInfoString" (Indicator: "GetLocaleInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|34_0" (Indicator: "GetLocaleInfo"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")34:T724,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "g____PInvoke|4_0" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExWT" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExWT" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")35:T41c,Found system information discovery API: "GetSystemInfo" in file "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002200.00000003.221942.33B90000.00000002.mdmp" Found system information discovery API: "g____PInvoke|98_0" in "00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002200.00000003.221942.CB110000.00000004.mdmp"36:T536,GetTickCount@KERNEL32.dll at 17910-13838-0000000140368420 GlobalMemoryStatusEx@KERNEL32.dll at 17910-14818-00000001405BF3D0 GetTickCount@KERNEL32.dll at 17910-14851-00000001401C2660 GetTickCount@KERNEL32.dll at 17910-14859-00000001401BFCD0 GetTickCount64@KERNEL32.dll at 17910-14892-0000000140278C90 GetTickCount64@KERNEL32.dll at 17910-14919-0000000140292050 GlobalMemoryStatusEx@KERNEL32.dll at 17910-15018-00000001405BF210 GetTickCount64@KERNEL32.dll at 17910-15831-0000000140194000 GetTickCount@KERNEL32.dll at 17910-15890-00000001401868C0 GetTickCount@KERNEL32.dll at 17910-15894-0000000140185DF0 GetTickCount@KERNEL32.dll at 17910-16490-00000001400CB9B0 GetTickCount@KERNEL32.dll at 17910-16630-00000001400A23C0 GetTickCount64@KERNEL32.dll at 17910-20335-00000001400D1785 GetTickCount@KERNEL32.dll at 17910-20522-00000001400E2220 GetTickCount@KERNEL32.dll at 17910-21710-000000014012BA7D GetTickCount@KERNEL32.dll at 17910-21712-00000001401C7160 GetTickCount@KERNEL32.dll at 17910-23083-00000001401847E5 GetTickCount64@KERNEL32.dll at 17910-23518-0000000140193BE7 GetTickCount64@KERNEL32.dll at 17910-24291-00000001401C0CE1 GlobalMemoryStatusEx@KERNEL32.dll at 17910-26369-0000000140264DFF GetTickCount64@KERNEL32.dll at 17910-26767-0000000140291B70 GetTickCount@KERNEL32.dll at 17910-36045-0000000140512F0037:T468,Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "Call to IsWow64Process2 failed: %u" (Indicator: "IsWow64Process"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "g____PInvoke|13_0" (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|14_0" (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "Call to IsWow64Process2 failed: %u" (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")38:T48e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|155_0" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")39:T48e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|155_0" (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetLocalTimeZoneFromWin32Data" (Indicator: "GetLocalTime"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")3a:T6ec,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "AssemblyNative_GetVersion" (Indicator: "GetVersion"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "AssemblyNative_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "nvalidOperation_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "(OSVersion's call to GetVersionEx failed." (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|22_0" (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|72_0" (Indicator: "GetVersion"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")3b:T53d,GetProcessHeap@KERNEL32.dll at 17910-2085-0000000140564830 GetProcessHeap@KERNEL32.dll at 17910-13970-00000001403450C0 GetProcessHeap@KERNEL32.dll at 17910-13977-0000000140345940 GetProcessHeap@KERNEL32.dll at 17910-13995-0000000140341DF0 GetProcessHeap@KERNEL32.dll at 17910-13998-0000000140342860 GetProcessHeap@KERNEL32.dll at 17910-14128-000000014032DB90 GetProcessHeap@KERNEL32.dll at 17910-14215-000000014032D2B0 GetProcessHeap@KERNEL32.dll at 17910-14525-00000001402C7DC0 GetProcessHeap@KERNEL32.dll at 17910-14544-00000001402BF500 GetProcessHeap@KERNEL32.dll at 17910-15087-000000014024C870 GetProcessHeap@KERNEL32.dll at 17910-15694-000000014011E5C0 GetProcessHeap@KERNEL32.dll at 17910-17152-000000014000CC10 GetProcessHeap@KERNEL32.dll at 17910-18401-0000000140047F11 GetProcessHeap@KERNEL32.dll at 17910-18535-0000000140054C80 GetProcessHeap@KERNEL32.dll at 17910-25085-0000000140201C48 GetProcessHeap@KERNEL32.dll at 17910-26823-000000014022E260 GetProcessHeap@KERNEL32.dll at 17910-27328-00000001402C9917 GetProcessHeap@KERNEL32.dll at 17910-28521-000000014032CDE0 GetProcessHeap@KERNEL32.dll at 17910-29425-00000001403432D2 GetProcessHeap@KERNEL32.dll at 17910-30106-000000014036BB28 OpenProcessToken@ADVAPI32.dll at 17910-37989-00000001405BEC19 GetProcessHeap@KERNEL32.dll at 17910-51635-0000000140201A703c:T921,Found string "set_UseShellExecute" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "ProcessStartInfo" (Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "antGetProcessStartInfo" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "antSetProcessStartInfo" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "ProcessStartInfo.LoadUserProfile and ProcessStartInfo.UseCredentialsForNetworkingOnly cannot both be set. Use only one of them." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "lProcessStartInfo.Password and ProcessStartInfo.PasswordInClearText cannot both be set. Use only one of them." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "NThe FileName property should not be a directory unless UseShellExecute is set." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "2UseShellExecute is not supported on this platform." (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "get_UseShellExecuteNotSupported" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "k__BackingField" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "get_UseShellExecute" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "get_CantGetProcessStartInfo" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "get_CantSetProcessStartInfo" (Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp")3d:T7d6,"g____PInvoke|10_0" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "StartWithCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "CreateProcessWT" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "CreateProcessWithLogonWT" (Indicator: "CreateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp")40:Tbbf,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "iled to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dCreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|63_0" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|84_0" (Indicator: "CreateFile"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")41:T5ea,SleepEx@KERNEL32.dll at 17910-11396-0000000140603B30 SleepEx@KERNEL32.dll at 17910-12294-000000014050AE30 SleepEx@KERNEL32.dll at 17910-13701-000000014039B0E0 SleepEx@KERNEL32.dll at 17910-13722-000000014039F490 WaitForMultipleObjects@KERNEL32.dll at 17910-13723-00000001402F9A00 WaitForSingleObjectEx@KERNEL32.dll at 17910-13860-0000000140358670 WaitForSingleObject@KERNEL32.dll at 17910-14296-00000001402FA0E0 WaitForSingleObject@KERNEL32.dll at 17910-14304-00000001402F72C0 WaitForSingleObject@KERNEL32.dll at 17910-14305-00000001402F71D0 WaitForSingleObject@KERNEL32.dll at 17910-14308-00000001402F6F30 WaitForSingleObject@KERNEL32.dll at 17910-14333-00000001402EEBB0 WaitForSingleObject@KERNEL32.dll at 17910-14335-00000001402EEAF0 SleepEx@KERNEL32.dll at 17910-14349-00000001402ECD90 SleepEx@KERNEL32.dll at 17910-14350-00000001402D7F60 WaitForSingleObject@KERNEL32.dll at 17910-14358-00000001402EA680 WaitForSingleObject@KERNEL32.dll at 17910-14362-00000001402EA890 SleepEx@KERNEL32.dll at 17910-14382-00000001402E82D0 SleepEx@KERNEL32.dll at 17910-14383-00000001402E6020 SleepEx@KERNEL32.dll at 17910-14387-00000001402E52E0 SleepEx@KERNEL32.dll at 17910-14408-00000001402E00E0 WaitForMultipleObjectsEx@KERNEL32.dll at 17910-14410-00000001402F6A80 WaitForSingleObject@KERNEL32.dll at 17910-14415-00000001402F6EF0 SleepEx@KERNEL32.dll at 17910-14436-00000001402D9D50 SleepEx@KERNEL32.dll at 17910-14437-00000001402D9560 WaitForSingleObject@KERNEL32.dll at 17910-14438-00000001402D97D042:T1655e,Found reference to API (Indicator: "EventRegister"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DeregisterEventSource"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RegisterEventSourceW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSidSubAuthority"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RegGetValueW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RevertToSelf"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "OpenThreadToken"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReportEventW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RegCloseKey"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "EventWrite"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DebugBreak"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SwitchToThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateActCtxW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "IsProcessInJob"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LocalFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateFileA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetStringTypeExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetProcAddress"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualUnlock"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualProtect"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReadFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InterlockedFlushSList"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SuspendThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InitializeContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LocateXStateFeature"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TlsFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFileSize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WriteFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetTickCount"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DecodePointer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetThreadPriority"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "QueueUserAPC"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ExitProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetLastError"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FlushInstructionCache"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadErrorMode"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CopyContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SleepEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "HeapAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FindNextFileW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLargePageMinimum"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TlsGetValue"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CloseHandle"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "EncodePointer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "IsWow64Process"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetErrorMode"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TerminateProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateFileW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "HeapFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VerSetConditionMask"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FindResourceW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetTempPathW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateMutexW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FindClose"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "OpenEventW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCPInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TlsSetValue"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetTickCount64"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ExitThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetStdHandle"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLastError"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "HeapDestroy"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ActivateActCtx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "MapViewOfFileEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateEventW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateNamedPipeA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "QueryInformationJobObject"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ResetEvent"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FreeLibrary"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateProcessW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetACP"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "TlsAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FormatMessageW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetEvent"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RaiseException"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ResumeThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SignalObjectAndWait"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "HeapCreate"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetSystemTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CancelIoEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "RtlUnwind"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "Sleep"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualQuery"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SetFilePointer"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SafeArrayPutElement"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetErrorInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VariantChangeType"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VariantClear"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SysFreeString"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SysStringLen"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SysAllocStringLen"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VariantInit"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "SysAllocString"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ShellExecuteW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "MessageBoxW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "LoadStringW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoGetClassObject"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoUninitialize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoTaskMemFree"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoCreateGuid"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoMarshalInterface"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetClassName"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetLength"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "MapViewOfFile3"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VirtualAlloc2"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetFileVersionInfoExW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "VerQueryValueW"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetProcessIdOfThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetThreadId"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API (Indicator: "SetThreadErrorMode"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "K32GetModuleBaseNameW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetModuleBaseName"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "K32EnumProcessModulesEx"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CryptImportPublicKeyInfoEx2"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptGetDefaultProviderW"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertGetIntendedKeyUsage"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertSaveStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertControlStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertAddCertificateLinkToStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "PFXExportCertStore"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameString"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptGetProvParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptSetProvParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptGetKeyParam"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CertFindExtension"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptFindOIDInfo"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "CryptGetDefaultProvider"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found reference to API (Indicator: "BCryptImportKeyPair"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStr"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertGetValidUsages"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptDecodeObject"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptFormatObject"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertSerializeCertificateStoreElement"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContext"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptGenKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CryptGetUserKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptExportKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertVerifyTimeValidity"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "NCryptGetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "NCryptSetProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "CertSetCertificateContextProperty"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetProcessIdOfThread"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetProcessGroupAffinity"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC2"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile3"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc2"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateMemoryResourceNotification"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "InitializeContext"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetXStateFeaturesMask"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CopyContext"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CoReleaseMarshalData"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualUnlock"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetLargePageMinimum"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "IsProcessInJob"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteTreeW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteTree"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValue"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKey"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistry"; Source: "00000000-00002200.00000003.221942.34790000.00000004.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "DeleteVolumeMountPointW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")43:Tbcc,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "seShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "NThe FileName property should not be a directory unless UseShellExecute is set." (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "2UseShellExecute is not supported on this platform." (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "ShellExecuteOnSTAThread" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "get_UseShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "k__BackingField" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "get_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "ShellExecuteFunction" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "ShellExecuteHelper" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")44:Tc3a,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dNtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|191_0" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|68_0" (Indicator: "CreateThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")45:T472,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp")46:T819,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "SOFTWARE\Classes\" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "HKCU\" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "SOFTWARE\dotnet" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "HKLM\" in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00002200.00000000.212594.34770000.00000004.mdmp "pera Software\Opera GX Stable" in Source: 00000000-00002200.00000000.212594.34770000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "HKCU\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "HKLM\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp47:T444,"raveSoftware\Brave-Browser\User Data" in Source: 00000000-00002200.00000000.212594.34770000.00000004.mdmp "pera Software\Opera GX Stable" in Source: 00000000-00002200.00000000.212594.34770000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "HKCU\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp "HKLM\" in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp48:T528,".ua" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20code%20signing%20pca%202024.crl0w" Pattern match: "http://www.microsoft.com/pkiops/certs/microsoft%20windows%20code%20signing%20pca%202024.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "https://ain" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www.hortcut" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www.c//dtd" Pattern match: "aka.ms/dotnet-warnings/{0" Heuristic match: "ssemblyname.name" Heuristic match: "z*.sh" Pattern match: "http://go.microsoft.com/fwlink/?linkid=522706" Pattern match: "https://aka.ms/globalizationinvariantmode" Pattern match: "https://aka.ms/binaryformatter" Pattern match: "https://aka.ms/nativeaot-compatibility" Pattern match: "https://go.microsoft.com/fwlink/?linkid=169180" Pattern match: "https://aka.ms/dotnet-illink/com" Pattern match: "https://aka.ms/dotnet-illink/nativehost"4e:T4c9d,Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00002200.00000000.212594.34750000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00002200.00000000.212594.36020000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2233907" - Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0tx*:qi!!wmicrosoft" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20code%20signing%20pca%202024.crl0wk0i0g[http://www.microsoft.com/pkiops/certs/microsoft%20windows%20code%20signing%20pca%202024.crt0e" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "http://www.microsoft.com06au63+s" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00002200.00000002.216437.347A0000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00002200.00000002.216437.35FE0000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewrapnonexceptionthrows.netcoreapp,version=v8.0frameworkdisplayname.net" - Source: "00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewindowsedefaultkeycontainerownercapihelpergetkeypairhelperrsakeyformathelpercryptothrowhelpertohexstringuppertohexarrayupperstringcomparercurrentuserhashproviderdispenserpbeparametergetproviderparameterreadivparametergetkeyparameterget_notaftergetnotafter_lazynotafterconfiguredtaskawaiterconfiguredvaluetaskawaitergetawaiterkdfworklimiterbinarywriterentertopointercryptdecodeobjectpointer_pointerbitconverterhexconvertercngasnformatterget_issuer_lazyissuerlowerlazyinitializerbcryptimportkeypairfloorgethrforlastwin32errorgetlastwin32errorget_unknown_errorgetlastpinvokeerrorsetlastpinvokeerrorget_x509chainbuildthrowoninternalerrorinitializex509chainbuildthrowoninternalerrorgetlastsystemerrorsetlastsystemerrornoerrordwerrorx509certificate2enumeratorienumeratoroidenumeratorx509certificateenumeratorx509extensionenumeratorsystem.collections.generic.ienumerable.getenumeratorsystem.collections.generic.ienumerable.getenumeratorsystem.collections.generic.ienumerable.getenumeratorsystem.collections.ienumerable.getenumeratorx509chainelementenumerator_enumeratorrandomnumbergeneratoractivator.ctorcbcofactor.cctormonitorcreatedecryptoruniversalcryptodecryptoruniversalcryptoencryptorstructuretoptrintptrcertgetcertificatecontextpropertyptrcertnametostrcertstoresaveasusecommassystem.runtime.numericssystem.numericssystem.security.cryptography.pkcsget_disablecertificatedownloadsset_disablecertificatedownloadss_validoidss_compatoids_oidsget_totalmillisecondsprimetwistededwardssystem.runtime.interopservicessystem.runtime.compilerservicessystem.resourcesfxresources.system.security.cryptography.sr.resourcesrc2bcryptmodesaesbcryptmodestripledesbcryptmodescertgetvalidusagesget_keyusagesget_enhancedkeyusages_enhancedkeyusagess_keyusageslocalappcontextswitchescngexportpoliciesinitializelookupdictionariesmicrosoft.win32.safehandless_handlesasnencodingrulesusenewlinesset_typessystem.security.cryptography.x509certificatesget_certificatesmaximumcachedcertificatesget_cryptography_pfx_nocertificatesdonotusequotesunprotectedattributesbagattributesrfc2898derivebytesget_paddingsizebytesequalbytesreadallbytesget_paddingsizeinbytesset_paddingsizeinbytesget_hashsizeinbytesget_blocksizeinbytesset_blocksizeinbytesget_hashlengthinbytesasbytesgetbytesattrvaluesbinaryprimitivesget_legalblocksizess_legalblocksizesget_legalkeysizess_legalkeysizess_defaultkeysizess_keysizesget_flagsset_flagscertnamestrtypeandflagscertfindflagsx509keystorageflagsmapkeystorageflagsx509keyusageflagsx500distinguishednameflagscertnameflagsexpectedformattypeflagsexpectedcontenttypeflagsmapx509storeflagscertcontrolstoreflagspfxcertstoreflagsdwcreateflagschainengineconfigflagsbcryptcreatehashflagsallflagscryptgetkeyparamflagsopenflagsdwstrongsignflagscertchainflagsx509verificationflagsget_verificationflagsset_verificationflags_verificationflagsmaprevocationflagsnoflagscryptimportpublickeyinfoflagsvalidatecspflagsbcryptopenalgorithmproviderflagsmapcspproviderflagsgetdefaultproviderflagsx509chainstatusflagscryptdecodeobjectflagspfxexportflagscryptacquirecontextflagsdwflagsmapcspkeyflagscertsetpropertyflags_flagss_x509chainerrormappings<>4__thissystem.diagnostics.codeanalysisfdwchecksget_cantransformmultipleblockssystem.threading.tasksequalss_dsapublickeyprivatekeylabelss_rsapublickeyprivatekeylabelss_ecpublickeyprivatekeylabelspbes2paramspbkdf2paramsget_extensionsrsacertificateextensionsmemoryextensions_lazyextensions_extensionscryptographicoperationsbitoperationsrecorditerationscounttotaliterations_iterationssystem.collectionscngkeyopenoptionsasnreaderoptionscngpropertyoptionsusesemicolonszerosoverlapsget_charsget_cryptography_algkdfrequirescharsalgorithmkdfrequirescharssystem.bufferscbufferspbuffersruntimehelperskeysizehelperscnghelpersrsaparametersecparametersget_cryptography_invalidrsaparametersrc2cbcparametersget_encodedparametersset_encodedparametersexportnamedcurveparametersget_keyalgorithmparameters_lazykeyalgorithmparametersiterationsfromparameterssavecspparametersdecodedssparametershasexplicitparametershasanyexplicitparametershasnullequivalentparametersimportparametersget_cryptography_invalidcurvekeyparameters_parametersverifycertificateignoringerrorscngbufferdescriptorstagclassprimeshortweierstrassget_argumentoutofrange_indexmustbelessx400addressipaddresscunusedbitsgeteffectivekeybitsget_chainelements_chainelements_elementscheckreadargumentscheckwriteargumentscheckcopytoargumentsvalidatebufferargumentsignoreinvalidbasicconstraintsinvalidnameconstraintsinvalidpolicyconstraintscbmoduluscycledetectionmodulusget_statusset_statusx509chainstatusget_chainstatus_lazychainstatuscerttrustinfostatusdwinfostatuscerttrusterrorstatusdwerrorstatusset_chainelementstatustruststatuspvextrapolicystatususingresourcekeyss_usingresourcekeysconcatget_formatcngkeyblobformatx500distinguishednameformatget_datetimeformat_formatcryptdecodeobjectreleasenativewithncryptfreeobjectcryptformatobjectcryptqueryobjectget_subjectgetissuerorsubject_lazysubjectdisconnect_rulesetisflagbitsetmachinekeysetephemeralkeysetuserkeysetdefaultkeysetpersistkeysetsystem.collections.ienumerator.resetfinalizehashandresettrygethashandresetget_offsetconfigureawaitop_implicitget_isexplicitisasciidigitisdigitemitget_pkcs12unspecifiedpassworditerationlimitinitializepkcs12unspecifiedpassworditerationlimitsetiterationlimitresetiterationlimitget_cryptography_exceedkdfextractlimitenforceiterationcountlimitskipinitexitmacsalt_saltgetvalueordefaultset_hresulttresultiasyncresulttasktoasyncresultgetresultsetresulttolowerinvariantrentreadkeyparametersilentkeyagreementcelementcertserializecertificatestoreelementx509chainelementrgpelementdataenciphermentkeyenciphermentpublicexponentsetparent_parentsystem.collections.ienumerator.currentsystem.collections.ienumerator.get_current_currentsystem.collections.concurrentencryptedcontenthasexcludednameconstrainthasnotdefinednameconstrainthasnotsupportednameconstrainthasnotpermittednameconstraintecpointget_thumbprintfindbythumbprintget_countgetbytecountnormalizeiterationcountgetiterationcountget_defaultiterationcountpopcount_count_syncroothrestrictedrootuntrustedrootexcluderoothexclusiverootauthrootcontainsanyexceptnopromptrsabcryptbasicsymmetriccipherlitebcryptbasicsymmetriccipherbcryptncryptpbes1decryptpbes2decryptpkcs12pbedecryptbcryptdecryptbcryptencryptstartserializedcertfromothercertconvertget_argument_destinationtooshortimportchecksha3supports_opaquetransportallowplaintextexportallowexportconfirmedcastiswindowsversionatleastdigestilistget_list_listpersisthrestrictedtrustcustomroottrustexplicitdistrustmanagedtounmanagedoutget_urlretrievaltimeoutset_urlretrievaltimeoutdwurlretrievaltimeoutsystem.collections.ienumerator.movenextsystem.text_usemachinecontextcryptacquirecontextcryptreleasecontextcertfreecertificatecontextcertduplicatecertificatecontextclowerqualitychaincontextrgplowerqualitychaincontextappcontextacquirecryptcontextinvokewithcertcontextpcertcontextget_dangerouscertcontextgetcertcontext_certcontextreaddeviceparameterverifycontextgetcipherivusesiv_currentivfttimelowget_nowdecodeobjectnothrow_endindexlchainindex_inputbufferindex_outputbufferindexlelementindex_startindexget_dayisvaliddayget_arraygetsubarrayallocateuninitializedarrayclonebytearraytobytearraytoarraytolpstrarrayclonekeysizesarraytrygetarrayignoreinvalidpolicyrequestedissuancepolicyget_certificatepolicyfindbycertificatepolicy_certificatepolicyx509chainpolicyget_chainpolicyset_chainpolicynoissuancechainpolicycertverifycertificatechainpolicy_chainpolicyget_applicationpolicyfindbyapplicationpolicy_applicationpolicyget_exportpolicyset_exportpolicysetexportpolicyget_cryptography_argecdhrequiresecdhkeyget_keyset_keyget_cryptography_argecdsarequiresecdsakeycbkeygetrsapublickeyimportrsapublickeydecodeecpublickeyget_publickeydecodeecdsapublickeyreadrsapublickeydecodepublickeydecodeecdiffiehellmanpublickeygetpublickey_lazypublickeyuseuserprotectedkeyusenonexportablekeyusearchivablekeymachinekeydisposekeygeneratekeyget_haspersistedprivatekeyget_hasephemeralprivatekeyget_hasprivatekeyget_containsprivatekey_lazyprivatekeyncryptdeletekeycngkeycngkeyuseexistingkey_hkeyissemiweakkeyisweakkeycreateephemeralkeyset_actualkeycryptgenkeyncryptopenkeyderivecipherkeycryptgetuserkeysetkeybcryptimportkeyncryptimportkeybcryptexportkeybcryptdestroykey_lazykey_keyverifyinternal.cryptographyfxresources.system.security.cryptographytomanagedfinallyget_publiconlyset_publiconly_fpubliconlyreadonly_validonlyendcertificateonlyopenexistingonlydecipheronlyencipheronlymultiplycreatecustomextensionifanyblockcopycircularcopysystem.buffers.binaryprimemontgomeryget_memoryget_rawdatamemoryzeromemorydecodeoctetstringasmemoryoidgroupwillnotuseactivedirectorycertverifytimevalidityop_equalityop_inequalityfixupkeyparityallowunknowncertificateauthoritysystem.securityget_cryptography_hashalgorithmnamenulloremptythrowifnulloremptyisnulloremptyget_isemptythrowifnotemptybcryptgetdwordpropertycustompropertycerthaspropertybcryptgetpropertyncryptgetpropertybcryptsetpropertyncryptsetpropertyncryptgetintpropertybcryptsetintpropertycertgetcertificatecontextpropertycertsetcertificatecontextpropertyrsa1(]b,=t]o-advapi32.dllentrypointcryptacquirecontextwtsetlasterrorsystem.runtime.interopservices.stringmarshalling," - Source: "00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewindows." - Source: "00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infoglobal.json" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-founddownload" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%s%sinstall" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found URL "http://g____PInvoke|11_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "g____PInvoke|13_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "g____PInvoke|6_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "g____PInvoke|9_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegEnumKeyExWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegOpenKeyExWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "RegQueryValueExWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry query API: "g____PInvoke|36_0" in "00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "g____PInvoke|29_0" in "00000000-00002200.00000003.221942.CB110000.00000004.mdmp" Found registry query API: "g____PInvoke|39_0" in "00000000-00002200.00000003.221942.CB110000.00000004.mdmp"50:T523,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dNtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "GetUserName"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")51:T1311,Found string "EnableAES" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aesdec" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aesimc" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aesenclast" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aesenc" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aesdeclast" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "aeskeygenassist" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "NYI: Implement AES intrinsic code generation" (Indicator: "aes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string ":\System.Security.Cryptography.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002200.00000000.212594.34630000.00000004.mdmp, 00000000-00002200.00000001.214516.34630000.00000004.mdmp, 00000000-00002200.00000002.216437.34630000.00000004.mdmp, 00000000-00002200.00000003.221942.34630000.00000004.mdmp") Found string "nvalid base64 payload" (Indicator: "base64"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "AesEngine" (Indicator: "aes"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found string "ryptography_ArgECDsaRequiresECDsaKey" (Indicator: "ecdsa"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "ryptography_CryptoStream_FlushFinalBlockTwicek" (Indicator: "cryptostream"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "ryptography_Rijndael_BlockSize" (Indicator: "rijndael"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "otSupported_ECDsa_Csp" (Indicator: "ecdsa"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "ryptography_CryptoStream_FlushFinalBlockTwice" (Indicator: "cryptostream"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "MS3DESwrap" (Indicator: "3des"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp") Found string "SAES_OAEP" (Indicator: "aes"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp")52:T103c,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dNtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "dGetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "QueryInformationProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "EnumProcessModules"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|25_0" (Indicator: "EnumProcesses"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "EnumProcessModulesUntilSuccess" (Indicator: "EnumProcessModules"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "K32EnumProcessModulesEx" (Indicator: "EnumProcessModules"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "K32EnumProcessModulesExT" (Indicator: "EnumProcessModules"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "K32EnumProcessesT" (Indicator: "EnumProcesses"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|272_0" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetCurrentProcessorId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")53:T115c,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g__GetTempPathW|60_0" (Indicator: "GetTempPath"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|131_0" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|152_0" (Indicator: "GetSystemDirectory"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|135_0" (Indicator: "GetFileAttributes"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|17_0" (Indicator: "QueryInformationFile"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|138_0" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")54:T7d0,Found string "r = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='DiagTrackLogonFilter'" -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "$w = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='DiagTrackWatchFilter'" -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -match 'DiagTrackLogonFilter' -or $_.Filter -match 'DiagTrackWatchFilter' } | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackLogonConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackWatchConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackLogonFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackWatchFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Get-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp")55:T51b,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "GetEnvironmentVariablesBlock" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|289_0" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")56:T961,file/memory contains long string with (Indicator: "secret"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") file/memory contains long string with (Indicator: "password"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found string "jStarting a process as another user with a specified password and domain is not supported on this platform." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found string "hAn encrypted key was found, but no password was provided. Use ImportFromEncryptedPem to import this key." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "AThe KDF for algorithm '{0}' requires a char-based password input." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "PThe keys from both parties must be the same size to generate a secret agreement." (Indicator: "secret"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "^The certificate data cannot be read with the provided password, the password may be incorrect." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "vThe EncryptedPrivateKeyInfo structure was decoded but was not successfully interpreted, the password may be incorrect." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "PKCS12 (PFX) without a supplied password has exceeded maximum allowed iterations. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") Found string "There was a problem with the PKCS12 (PFX) without a supplied password. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information." (Indicator: "password"; Source: "00000000-00002200.00000001.214516.36250000.00000004.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")57:T558,Found registry deletion API: "g____PInvoke|3_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "g____PInvoke|4_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "g____PInvoke|5_0" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp" Found registry deletion API: "RegDeleteValueWTU" in "00000000-00002200.00000003.221942.34790000.00000004.mdmp"58:T5ec,Found string "Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -match 'DiagTrackLogonFilter' -or $_.Filter -match 'DiagTrackWatchFilter' } | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Remove-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackLogonConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Remove-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='DiagTrackWatchConsumer'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Remove-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackLogonFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Remove-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found string "Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='DiagTrackWatchFilter'" -ErrorAction SilentlyContinue | Remove-WmiObject -ErrorAction SilentlyContinue" (Indicator: "Remove-WmiObject"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp")59:T6aa,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SeDebugPrivilegeA" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002200.00000000.212594.34630000.00000004.mdmp, 00000000-00002200.00000001.214516.34630000.00000004.mdmp, 00000000-00002200.00000002.216437.34630000.00000004.mdmp, 00000000-00002200.00000003.221942.34630000.00000004.mdmp") Found reference to API "g____PInvoke|7_0" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "LookupPrivilegeValueWT" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp")5a:T9f0,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")5b:T666,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "SafeExitProcess: exitCode = %d sca = %d" (Indicator: "ExitProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "In EEPolicy::HandleExitProcess" (Indicator: "ExitProcess"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "dTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp") Found reference to API "g____PInvoke|22_0" (Indicator: "TerminateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "SafeExitProcess: exitCode = %d sca = %d" (Indicator: "ExitProcess"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "In EEPolicy::HandleExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp")5c:T45e,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002200.00000003.221942.33B90000.00000002.mdmp") Found reference to API "g____PInvoke|304_0" (Indicator: "CreateMutex"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "g____PInvoke|305_0" (Indicator: "ReleaseMutex"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00002200.00000003.221942.CB110000.00000004.mdmp")5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3AAB/////////////////9wAAf/////////////////cAAH////ZmZmZmZv/////3AAB////2ZmZmZmb/////9wAAf///9mZmZmZm93d///cAAH93f/ZmZmZmZv/////3AAB////2ZmZmZmb3d3d39wAAf///9mZmZmZm//////cAAH93f/ZmZmZmZvd3d3f3AAB////2ZmZmZmb/////9wAAf///9mZmZmZm93d3d/cAAH93f/ZmZmZmZv/////3AAB////2ZmZmZmb3d3d39wAAf///9mZmZmZm//////cAAH93f/ZmZmZmZvd3d3f3AAB////2ZmZmZmb/////9wAAf/////////////////cAAH/////////////////3AAB3d3d3d3d3d3d3d4eHhwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":78,"unified_at_epoch_ms":1791826096226,"unified_at":"2026-10-12T17:28:16.226Z","metadata":{"hashes":{"sha256":"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0","sha1":"3872d736cae6bd178458835090df0405f51e3c11","md5":"a60b7363180407d3ff8ead42c1b53183","sha512":"8b29212dec283505d68e7a3fbc752ac8178d0741284d7f45371d55fb48b163b0ecebb56dda9a15d91127b9ef6328e17b99712ef14decb224ceac3c07e55aaa20","ssdeep":"196608:WdvIyQs3CY9eO8OwcPFGUeuPIzBGuwtq/YHg7DQ:Wdrz7whrQIzBGxTkQ","ssdeep_chunks":["196608:WdvIyQs","196608:dvIyQs3","196608:vIyQs3C","196608:IyQs3CY","196608:yQs3CY9","196608:Qs3CY9e","196608:s3CY9eO","196608:3CY9eO8","196608:CY9eO8O","196608:Y9eO8Ow","196608:9eO8Owc","196608:eO8OwcP","196608:O8OwcPF","196608:8OwcPFG","196608:OwcPFGU","196608:wcPFGUe","196608:cPFGUeu","196608:PFGUeuP","196608:FGUeuPI","196608:GUeuPIz","196608:UeuPIzB","196608:euPIzBG","196608:uPIzBGu","196608:PIzBGuw","196608:IzBGuwt","196608:zBGuwtq","196608:BGuwtq/","196608:Guwtq/Y","196608:uwtq/YH","196608:wtq/YHg","196608:tq/YHg7","196608:q/YHg7D","196608:/YHg7DQ","393216:WdvIyQs","393216:dvIyQs3","393216:vIyQs3C","393216:IyQs3CY","393216:yQs3CY9","393216:Qs3CY9e","393216:s3CY9eO","393216:3CY9eO8","393216:CY9eO8O","393216:Y9eO8Ow","393216:9eO8Owc","393216:eO8OwcP","393216:O8OwcPF","393216:8OwcPFG","393216:OwcPFGU","393216:wcPFGUe","393216:cPFGUeu","393216:PFGUeuP","393216:FGUeuPI","393216:GUeuPIz","393216:UeuPIzB","393216:euPIzBG","393216:uPIzBGu","393216:PIzBGuw","393216:IzBGuwt","393216:zBGuwtq","393216:BGuwtq/","393216:Guwtq/Y","393216:uwtq/YH","393216:wtq/YHg","393216:tq/YHg7","393216:q/YHg7D","393216:/YHg7DQ","196608:Wdrz7wh","196608:drz7whr","196608:rz7whrQ","196608:z7whrQI","196608:7whrQIz","196608:whrQIzB","196608:hrQIzBG","196608:rQIzBGx","196608:QIzBGxT","196608:IzBGxTk","196608:zBGxTkQ"],"imphash":"70d2e884fa127843c5bcbb53da86b6c8"},"file_info":{"file_name":"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":11391282,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774203201000,"last_seen":1777115686000,"last_multi_scan":1777115686000}},"detections":{"summary":{"verdict":"malicious","score":78,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":190,"suspicious_count":16,"malicious_count":2,"total":208},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.NROA-1563","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.JJE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains reference to shellcode"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Able to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Able to perform reflective code loading"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to measure performance"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"malicious","value":"Reads the SCSI logical unit identifier"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains ability to enumerate system services using Tasklist"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"NoProfile -Command \"Add-MpPreference -ExclusionPath '\" (Indicator: \"add-mppreference\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to perform reflective code loading","description":"Found string \"2Assembly.LoadFrom with hashValue is not supported.\" (Indicator: \"assembly.load\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":3,"id":"string-678","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load module (Dotnet string)","description":"Observed string: \"2Assembly.LoadFrom with hashValue is not supported.\" (Indicator: \"Assembly.Load\") in Source: 00000000-00002200.00000003.221942.CB110000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"SetLastAccessTime\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"dNtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002200.00000003.221942.33B90000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2c","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"g____PInvoke|20_0\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp\")\n Found reference to API \"g____PInvoke|20_0\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$30","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Able to access crypto wallet extension (string)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\"; Source: \"00000000-00002200.00000000.212594.34750000.00000004.mdmp, 00000000-00002200.00000000.212594.36020000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000001.214516.36250000.00000004.mdmp, 00000000-00002200.00000002.216437.347A0000.00000004.mdmp, 00000000-00002200.00000002.216437.35FE0000.00000004.mdmp, 00000000-00002200.00000002.216437.36450000.00000004.mdmp, 00000000-00002200.00000003.221942.34790000.00000004.mdmp, 00000000-00002200.00000003.221942.35FA0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002200-00000C2C-2318929978\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"(OSVersion's call to GetVersionEx failed.\" (Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"g____PInvoke|0_0\" (Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found string \"GetUserNameExW\" (Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002200-00000C2C-2318929978\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found string \"dGetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"$32","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"H_EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"ExecuteViaEnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"dEnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"H_EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"ExecuteViaEnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"dEnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"g____PInvoke|35_0\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002200.00000002.216437.33D68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"g____PInvoke|30_0\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"K32GetModuleFileNameExWT\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"dGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"MarshalNative_GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found string \"MarshalNative_GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$56","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"oftware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002200.00000000.212594.34770000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Canary failed to create ping event. gle=%d\" (Indicator: \"ping\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found string \"tasklist /fi \"PID eq\" (Indicator: \"tasklist\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\"), Found string \"tasklist /fi \"PID eq\" (Indicator: \"tasklist /fi\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found string \"tasklist /FI \"PID eq\" (Indicator: \"tasklist\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\"), Found string \"tasklist /FI \"PID eq\" (Indicator: \"tasklist /fi\"; Source: \"00000000-00002200.00000000.212594.34770000.00000004.mdmp\")\n Found string \"=The provided value is not a valid DNS hostname or IP Address.\" (Indicator: \"hostname\"; Source: \"00000000-00002200.00000001.214516.36250000.00000004.mdmp\")\n Found string \"Canary failed to create ping event. gle=%d\" (Indicator: \"ping\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"g____PInvoke|10_0\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00002200.00000001.214516.347B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp, 00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"g____PInvoke|80_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"g____PInvoke|202_0\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002200.00000003.221942.CB110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002200.00000002.216437.33D68000.00000002.mdmp, 00000000-00002200.00000003.221942.33B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: 6d21d449250752edd51f054e809871c1548c2dca4596785d9b445e89058589c0.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69eca225c26f424a4207d472"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"