24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 91:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.LogMeIn Sample 6f980cf9cbee… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f980cf9cbee…. Malware family: Trojan.LogMeIn. Threat score 100/100. 9/27 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8","keywords":["Malicious","Trojan.LogMeIn","malware analysis","sandbox report","threat intelligence","6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8"],"about":{"@type":"SoftwareApplication","name":"ZoomWorkspace.exe","applicationCategory":["peexe","executable"],"identifier":"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.LogMeIn","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T405,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe")26:Td1b,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "Check failed: WaitForSingleObject(semaphore_, INFINITE) == WAIT_OBJECT_0" (Indicator: "WaitForSingleObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")27:T5d6,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")28:Td51,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIInputHook32.dll")29:Td92,file/memory contains long string with (Indicator: "SHA384"; File: "lmiscrhook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "lmiscrhook32.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIInputHook32.dll") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000836-00000CC2-1871221399") Found reference to "RC2_cbc_encrypt" (Indicator: "RC2"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "RC2_ofb64_encrypt" (Indicator: "RC2"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "RC2_set_key" (Indicator: "RC2"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "RC2_cfb64_encrypt" (Indicator: "RC2"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "RC2_ecb_encrypt" (Indicator: "RC2"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to "http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found reference to "http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp")2a:Tbd0,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" queried SystemProcessInformation at 00000000-00004728-00000C15-1864160627 [PID: 4728] "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" queried SystemProcessInformation at 00000000-00004728-00000C15-1864169309 [PID: 4728] "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" queried SystemProcessInformation at 00000000-00004728-00000C15-1864806803 [PID: 4728] "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" queried SystemProcessInformation at 00000000-00004728-00000C15-1864816510 [PID: 4728] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868188579 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868200685 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868377053 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868384400 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868779382 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868787599 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868917691 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1868925702 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869468200 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869477020 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869604168 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869619425 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869839664 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1869848605 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870227856 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870236101 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870320285 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870328132 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870480365 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870489087 [PID: 836] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00000836-00000C15-1870741858 [PID: 836]2b:T45b,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp")2c:Tfe0,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-1528-0091CF20 Assembly shows XOR instruction xor byte ptr [ebp+45C68045h] cl in Stream UID: 00000000-00004728-50046-1528-0091CF20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-1535-008898A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-1536-008954C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-1540-0087A530 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-1580-008AC560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-2339-008881B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004728-50046-2339-008881B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-2364-00892980 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004728-50046-2364-00892980 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-2645-008F7460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004728-50046-2645-008F7460 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-2688-008F5780 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-3070-008DBC00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-4158-008A9820 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004728-50046-4158-008A9820 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-4210-008C6310 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004728-50046-4488-00924560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-3-003620D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-44-003467BB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-44-003467BB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-56-0034775F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-130-00357ABC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-130-00357ABC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-163-00354E85 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-163-00354E85 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-234-003563B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-234-003563B5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-257-003577E3 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00000836-55879-309-0035870C Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00000836-55879-309-0035870C Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00000836-55879-309-0035870C Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00000836-55879-309-0035870C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-330-003535BB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-330-003535BB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-333-003531C6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-333-003531C6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-350-003560B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-350-003560B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000836-55879-353-00355E50 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000836-55879-353-00355E502d:T507,Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe")2e:Tffb,Contains base64 string in header "comX" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "3506702571605499921X" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Hash" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 3506702571605499921X-Version: 1.27.1.2836X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacdContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0"2f:T68d,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption30:T4d7,Found string "27247736097,2180,3194,,GetUserNameExW,secur32.dll,"00:47:53.562",RX=0,PX=0" (Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found string "The credential consists of both Password and UserName being supplied together in a pair." (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "VPN.UserName=" (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "providerFilter=Yes VPN.UserName="UserXXX"" (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp")31:T6d4,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMISupport7x32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "lmiscrhook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "lmiscrhook32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "g2rvdd.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIInputHook32.dll") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")32:Tb6c,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "25842319926,5424,3152,,GetLocaleInfoW,kernel32.dll,"00:47:52.968",RX=0,PX=0" (Indicator: "GetLocaleInfo"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp")33:T64a,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")34:T5ba,Found system information discovery API: "GetEnvironmentStringsW" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "NtQuerySystemInformation" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "GetSystemInfo" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "GetUserObjectInformationW" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "GetNativeSystemInfo" in file "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in file "00000000-00006496.00000000.185497.001E1000.00000020.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in file "00000000-00006496.00000000.185497.001E1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp"35:T14a7,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004728) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000089771c3df9021cf4d30000000000e9028977000000000000000001fcce72280200000000000001fcce72000000003900f9020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b3720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cf4d30024db3a4ba025fa02f4f3d300b4878877448595770000000000000000000000000000000001000000bd488a77000000000100000008000000a025fa0220f4d300c28fe5750000b37200000000 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009577000000000000000060fdf9026cfdf902a0f3d3003ec7887760fdf902000000001c038b778a0289771e00000040f3d30000000000d8f3d300c202897784fdf9021cf4d30000000000e90289770000000000000000bd0504724802000000000000bd050472000000002e00f902000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cf4d30024db3a4be8f3d300cd01897760fdf902 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000836)36:T6f5,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000836-55879-175-00356BC4 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000836-55879-182-003565BD GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-195-00356B40 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000836-55879-234-003563B5 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000836-55879-235-00355CD7 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000836-55879-236-00355DBD GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-238-003561D9 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000836-55879-239-00355D22 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-350-003560B0 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-351-003562DF GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-353-00355E50 GetLocaleInfoEx@KERNEL32.DLL at 00000000-00000836-55879-1092-003403DC GetLocaleInfoW@KERNEL32.DLL at 00000000-00000836-55879-1402-00355C32 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006496-61847-400-00238E4E EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006496-61847-408-00238938 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006496-61847-418-00238E0F GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006496-61847-456-0024216C EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006496-61847-457-00241AA0 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006496-61847-458-00241B86 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006496-61847-460-00241F8A EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006496-61847-461-00241AEB GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006496-61847-874-002196A0 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006496-61847-2455-002419FF GetLocaleInfoW@KERNEL32.DLL at 00000000-00006496-61847-2458-00241C13 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006496-61847-2459-0024209037:T644,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GoToResolveProcessChecker.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GoToResolveCrashHandler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")38:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")39:T5e9,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "27451769781,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.640",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "26843816581,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.390",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27211243670,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.546",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27453118863,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.640",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp")3a:T852,"GoToResolveUnattended.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")3b:T105c,"GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1899996077 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1899996259 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\fontdrvhost.exe" at 00000000-00001428-00000C17-1899997887 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1899998060 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1899999605 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1899999783 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\fontdrvhost.exe" at 00000000-00001428-00000C17-1900000839 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900001039 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900002994 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900003173 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900004236 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900004408 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900005413 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900005600 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900006710 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900006885 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900007930 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900008108 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900009619 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900009797 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900010842 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900011019 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-1900012068 "GoToResolveProcessChecker.exe" queries volume information of "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" at 00000000-00001428-00000C17-1900012242 "GoToResolveProcessChecker.exe" queries volume information of "C:\Windows\SysWOW64\svchost.exe" at 00000000-00001428-00000C17-19000135473c:T447,file/memory contains long string(File: "LMISupport7x32.dll") file/memory contains long string(File: "LMISupportM32.exe") file/memory contains long string(File: "lmiscrhook64.dll") file/memory contains long string(File: "lmiscrhook32.dll") file/memory contains long string(File: "LMIFilterHook64.dll") file/memory contains long string(File: "LMIInputHook64.dll") file/memory contains long string(File: "g2rvdd.dll") file/memory contains long string(File: "LMIFilterHook32.dll") file/memory contains long string(File: "LMIInputHook32.dll") Found string "GetCommandLineW" (Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")3d:T9b6,"GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")3e:T684,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CERTIFICATES"; Key: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CRLS"; Key: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB")3f:Ta56,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\GoTo Resolve Installer (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter x86 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateDirectoryW" with parameter x64 (UID: 00000000-00004728) "GoToResolveUnattended.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata (UID: 00000000-00000836) "GoToResolveProcessChecker.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\reports (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\attachments (UID: 00000000-00001428) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\reports (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\attachments (UID: 00000000-00006496)40:T421,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" -regsvc" - (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "CreateProcessW" with parameter "cmd.exe /S /C ""C:\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd" "C:\6f980cf9cbeee09b45bb913ddda8159a3" - (UID: 00000000-00004728) "GoToResolveUnattended.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpi" - (UID: 00000000-00000836) "cmd.exe" called "CreateProcessW" with parameter "timeout /T 3" - (UID: 00000000-00003180) "GoToResolveProcessChecker.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveCrashHandler.exe" "--database=%PROGRAMFILES%\(x86" - (UID: 00000000-00001428)41:T7ad6,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004728) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00000836) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003180) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003180) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003180) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003180) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001428) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006496) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00001056)42:T17a69,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004728) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SHDeleteKeyW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter PathRenameExtensionW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetKernelObjectSecurity (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter MakeAbsoluteSD (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetKernelObjectSecurity (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter IsTokenRestricted (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaRetrievePrivateData (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaStorePrivateData (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LsaNtStatusToWinError (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymGetModuleBase64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymGetModuleInfo64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymLoadModule64 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SymFromAddr (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSQueryUserToken (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSEnumerateProcessesW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSSendMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSDisconnectSession (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetVolumePathNamesForVolumeNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RegQueryReflectionKey (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RegEnableReflectionKey (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RegDisableReflectionKey (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter ExtensionApiVersion (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter OpenEventW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter InternetGetLastResponseInfoW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter OpenInputDesktop (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SnmpExtensionClose (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DwmEnableComposition (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter LockWorkStation (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter MapVirtualKeyExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter VkKeyScanExW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter VkKeyScanW (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter UnattendedEntry (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000836) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000836) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003180) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003180) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SHDeleteKeyW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathRenameExtensionW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetKernelObjectSecurity (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MakeAbsoluteSD (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetKernelObjectSecurity (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsTokenRestricted (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaRetrievePrivateData (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaStorePrivateData (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaNtStatusToWinError (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetModuleBase64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetModuleInfo64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymLoadModule64 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymFromAddr (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSQueryUserToken (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSEnumerateProcessesW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSSendMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSDisconnectSession (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVolumePathNamesForVolumeNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegQueryReflectionKey (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegEnableReflectionKey (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegDisableReflectionKey (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ExtensionApiVersion (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenEventW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InternetGetLastResponseInfoW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenInputDesktop (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SnmpExtensionClose (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmEnableComposition (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LockWorkStation (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MapVirtualKeyExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VkKeyScanExW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VkKeyScanW (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ProcessCheckerEntry (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005716) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SHDeleteKeyW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathStripPathW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathRemoveExtensionW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PathRenameExtensionW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetKernelObjectSecurity (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MakeAbsoluteSD (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetKernelObjectSecurity (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAclInformation (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AddAce (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsTokenRestricted (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaRetrievePrivateData (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaStorePrivateData (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LsaNtStatusToWinError (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetModuleBase64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetModuleInfo64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymLoadModule64 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SymFromAddr (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSQueryUserToken (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSEnumerateProcessesW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSSendMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSDisconnectSession (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVolumePathNamesForVolumeNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegQueryReflectionKey (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegEnableReflectionKey (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegDisableReflectionKey (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ExtensionApiVersion (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenEventW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InternetGetLastResponseInfoW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter OpenInputDesktop (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SnmpExtensionClose (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmEnableComposition (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DwmGetWindowAttribute (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter LockWorkStation (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter MapVirtualKeyExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VkKeyScanExW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter VkKeyScanW (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter ProcessCheckerEntry (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter AccProvGetCapabilities (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00001428) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00006496) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001056) "GoToResolveUnattended.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00001056)43:T539,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateFile() error: {}" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateFileMapping() error: {}" (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")44:T16960,Found reference to API (Indicator: "StartServiceW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ControlService"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "BuildSecurityDescriptorW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumServicesStatusW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryServiceConfigW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenServiceW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegDeleteTreeA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeleteService"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegCloseKey"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CryptProtectData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertGetNameStringW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertCloseStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CertOpenStore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FormatMessageW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CompareStringW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LCMapStringA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindClose"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WaitNamedPipeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateFileW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeleteFileW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "lstrcatW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EncodePointer"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindNextFileW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadResource"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RaiseException"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LockFileEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "lstrcpyW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetACP"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReadFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LCMapStringW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TlsGetValue"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "lstrlenW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateEventW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCPInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenEventA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TlsSetValue"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetStdHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileType"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetVersionExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CompareFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsValidLocale"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CopyFileExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetStringTypeExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LocalFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FormatMessageA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetVersion"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TlsFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "MoveFileExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SleepEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TlsAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProcAddress"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetStdHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ResetEvent"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LockResource"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindResourceW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FreeLibrary"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "TerminateProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateProcessW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ExitThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateEventA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "Sleep"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateDirectoryExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CompareStringEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ExitProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SizeofResource"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "UnlockFileEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WriteFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DecodePointer"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LocalAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetEvent"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsWow64Process"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLocalTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetOEMCP"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CloseHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VariantClear"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "PathIsDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadStringA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ShowWindow"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "wsprintfW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "gethostname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WSAStartup"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WSACleanup"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlUnwind"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileAttributes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeleteFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "BuildSecurityDescriptor"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindNextFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstFileEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RemoveDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "NtCreateFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "NtQueryDirectoryFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlsAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlsFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlsGetValue"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlsSetValue"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DisplayVersion"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CryptMsgClose"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CryptMsgGetParam"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReportEventW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTempPathW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualLock"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DeleteFiber"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateFiberEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsThreadAFiber"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConvertThreadToFiberEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualProtect"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "MessageBoxW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "recvfrom"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "inet_addr"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ntohs"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "getservbyport"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "htonl"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WSASetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "closesocket"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "getsockname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "gethostbyname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "htons"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "getsockopt"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ioctlsocket"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "inet_ntoa"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "getservbyname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaStorePrivateData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaRetrievePrivateData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaOpenPolicy"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaClose"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaNtStatusToWinError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CryptUnprotectData"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProductInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiDestroyDriverInfoList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiCreateDeviceInfoList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiBuildDriverInfoList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiEnumDriverInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetupDiGetDriverInfoDetailW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00000836.00000001.185126.00321000.00000020.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FreeSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EqualSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsTokenRestricted"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetTokenInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateMutexW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "Thread32Next"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapCreate"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "QueryDosDeviceW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetTickCount"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindVolumeClose"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "Thread32First"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "Process32FirstW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenEventW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapDestroy"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ResumeThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "Process32NextW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindNextVolumeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstVolumeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SysAllocString"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SysFreeString"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumProcessModules"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumProcesses"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "NdrOleFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "NdrOleAllocate"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "PathStripPathW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "PathRemoveExtensionW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenWindowStationW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CloseWindowStation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CloseDesktop"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumDesktopWindows"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "EnumDesktopsW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "MessageBoxA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CoUninitialize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualQuery"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaDeregisterLogonProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LsaConnectUntrusted"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetThreadContext"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SuspendThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetProcessId"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "HeapQueryInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "VerQueryValue"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpen"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpConnect"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpWriteData"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenThread"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "CreateSemaphore"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "NtResumeProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClass"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "GetMessage"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClass"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "CreateEvent"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "ImpersonateNamedPipeClient"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileName"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLongPtr"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindNextFileA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FindResourceExW"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "OpenThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp")45:T506,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")46:T5ce,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "void *__cdecl crashpad::`anonymous-namespace'::OpenThread(const struct crashpad::process_types::SYSTEM_THREAD_INFORMATION &)" (Indicator: "OpenThread"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe")47:T6bb,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")48:T903,"libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-3.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-3.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-3.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-3.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-3.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-3.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-3.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-3.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-3.dll" contains export function called "AES_decrypt" at ordinal 2549:T968,"SOFTWARE\GoTo Resolve Customer Attended App" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\GoTo Resolve Unattended" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\GoTo Resolve Unattended\" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 61847-1026-00210AD0 "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000836.00000000.183492.0302B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000836.00000001.185126.02F80000.00000004.mdmp "SOFTWARE\GoTo Resolve Unattended\3506702571605499921" in Source: 00000000-00000836.00000001.185126.05D14000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00000836.00000001.185126.06020000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00000836.00000001.185126.06020000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000836.00000001.185126.064DB000.00000004.mdmp4a:T8ea,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter %LOCALAPPDATA%\GoTo Resolve Installer (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter %LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter x86 (UID: 00000000-00004728) "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" with parameter x64 (UID: 00000000-00004728) "GoToResolveUnattended.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata (UID: 00000000-00000836) "GoToResolveProcessChecker.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\reports (UID: 00000000-00001428) "GoToResolveProcessChecker.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\attachments (UID: 00000000-00001428) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\reports (UID: 00000000-00006496) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\attachments (UID: 00000000-00006496)4b:T91e,Process 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4728:168:WilStaging_02" Process 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4728:64:WilError_01" Process 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe created mutex with name "Local\SM0:4728:168:WilStaging_02" Process 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe created mutex with name "SM0:4728:64:WilError_01" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:836:168:WilStaging_02" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:836:64:WilError_01" Process GoToResolveUnattended.exe created mutex with name "DBWinMutex" Process GoToResolveUnattended.exe created mutex with name "SM0:836:64:WilError_01" Process GoToResolveUnattended.exe created mutex with name "Local\SM0:836:168:WilStaging_02" Process GoToResolveUnattended.exe created mutex with name "Local\SM0:836:64:WilError_01" Process GoToResolveUnattended.exe created mutex with name "Local\ZonesCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:836:64:WilError_01" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process GoToResolveProcessChecker.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process GoToResolveProcessChecker.exe created mutex with name "DBWinMutex" Process GoToResolveProcessChecker.exe created mutex with name "\BaseNamedObjects\DBWinMutex" Process GoToResolveProcessChecker.exe created mutex with name "\BaseNamedObjects\GoToResolveUnattended_3506702571605499921_Service"4c:Tf7e,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3-x64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveTools64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "PasswordPrivacyDll.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveTools32.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnlock64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "GoToResolveCrashHandler.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "legacy.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveUnlock32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "LMISupport7x64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "GoToResolveProcessChecker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveLoggerProcess.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveRemoteControl.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnattendedUi.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnattended.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnattendedRemover.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveExternalModuleHandler.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveRegistryEditor.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveNetworkChecker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveServiceManager.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE4d:Tbef,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000836.00000000.183492.0302B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000836.00000001.185126.02F80000.00000004.mdmp "SOFTWARE\GoTo Resolve Unattended\3506702571605499921" in Source: 00000000-00000836.00000001.185126.05D14000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00000836.00000001.185126.06020000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00000836.00000001.185126.06020000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000836.00000001.185126.064DB000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00000836.00000001.185126.6EE35000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00000836.00000001.185126.6EE35000.00000004.mdmp "SOFTWARE\GoTo Resolve Customer Attended App" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\GoTo Resolve Unattended" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\GoTo Resolve Unattended\" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended " in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: 00000000-00004728.00000001.183812.00979000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended 3506702571605499921" in Source: 00000000-00005716.00000001.185105.00A85000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005716.00000001.185105.6EE35000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005716.00000001.185105.6EE35000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006496.00000000.185497.00255000.00000002.mdmp4e:T1968,"GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:23:49 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: e3ee3f8c-2a71-46c9-88fe-6f5a0bd76ecf Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty3v4Gl-oAMEK-g= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-69110665-58d90a771edcff6a6693a569 Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:24:00 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: 0577e556-0ab8-4f84-a63d-794bda67b5ca Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty3xlHyOoAMEIBw= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-69110670-6d03d2fb1e0e0d66039f219d Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:24:10 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: 224e9892-353d-42c6-b2ea-f61394b1d353 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty3zPEEtIAMEleQ= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-6911067a-3b6a846222c25cf85a83bd2f Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:24:25 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: 31af8c73-68db-40ca-96ab-b6901a56179e Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty31fEygoAMEobQ= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-69110689-61108c6701dd31c25b362759 Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32....... "GET / HTTP/1.1 Host: devices-iot.console.gotoresolve.com Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 404 Not Found content-type: application/json content-length: 72 date: Sun 09 Nov 2025 21:24:43 GMT x-amzn-RequestId: f33b4b87-d589-53db-f19b-33591ff8a853 connection: keep-alive x-amzn-ErrorType: ResourceNotFoundException: with response body ==>37623A32323A36643A36353A37333A37333A36313A36373A36353A32323A33613A32323A34653A36663A37343A32303A34363A36663A37353A36653A36343A32....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:24:49 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: 8d46f7fd-291b-4774-a4be-d54b80345489 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty35VHMoIAMEF1A= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-691106a1-09a12c2f55155b4d2667d649 Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 3506702571605499921 X-Version: 1.27.1.2836 X-ZeroTrust-Hash: 39908f18a415dbcb23829a3479f62998a602aa5ac39e7b6ae087f354a32abacd Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Sun 09 Nov 2025 21:25:24 GMT Content-Type: application/json Content-Length: 5297 Connection: keep-alive x-amzn-RequestId: 71b08072-ba9a-4587-b3ce-0bba6fae9c34 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: Ty3-tHTnIAMEJVQ= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-691106c4-73531d4b30b6c1250ebb382c Access-Control-Allow-Credentials: true with response body ==>37623A32323A37333A36383A36313A37323A36353A36343A34333A36353A37323A37343A36393A36363A36393A36333A36313A37343A36353A32323A33613A32.......4f:T56e4,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "KERNEL32" at base 776f0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d50000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "KERNEL32.DLL" at base 776f0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "SHELL32.DLL" at base 74850000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "RPCRT4.DLL" at base 76390000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "NTDLL.DLL" at base 77840000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741b0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "COMCTL32.DLL" at base 73240000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "USER32.DLL" at base 76f40000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73060000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d10000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 736f0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "ATLTHUNK.DLL" at base 73050000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 775a0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75f30000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "OLEAUT32.DLL" at base 774f0000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76f40000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76f40000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76c80000 "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77590000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d50000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d50000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d50000 "GoToResolveUnattended.exe" loaded module "KERNEL32" at base 776f0000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75d50000 "GoToResolveUnattended.exe" loaded module "ADVAPI32.DLL" at base 76c00000 "GoToResolveUnattended.exe" loaded module "AVRT.DLL" at base 73040000 "GoToResolveUnattended.exe" loaded module "BCRYPT.DLL" at base 735e0000 "GoToResolveUnattended.exe" loaded module "CRYPT32.DLL" at base 76170000 "GoToResolveUnattended.exe" loaded module "D2D1.DLL" at base 72b30000 "GoToResolveUnattended.exe" loaded module "GDI32.DLL" at base 769c0000 "GoToResolveUnattended.exe" loaded module "D3D11.DLL" at base 728f0000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776f0000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 75d50000 "GoToResolveUnattended.exe" loaded module "DBGHELP.DLL" at base 726c0000 "GoToResolveUnattended.exe" loaded module "DWMAPI.DLL" at base 73160000 "GoToResolveUnattended.exe" loaded module "DWRITE.DLL" at base 72440000 "GoToResolveUnattended.exe" loaded module "DXGI.DLL" at base 72850000 "GoToResolveUnattended.exe" loaded module "GDIPLUS.DLL" at base 73fa0000 "GoToResolveUnattended.exe" loaded module "IMM32.DLL" at base 75c50000 "GoToResolveUnattended.exe" loaded module "IPHLPAPI.DLL" at base 74180000 "GoToResolveUnattended.exe" loaded module "KERNEL32.DLL" at base 776f0000 "GoToResolveUnattended.exe" loaded module "MPR.DLL" at base 74160000 "GoToResolveUnattended.exe" loaded module "MSDMO.DLL" at base 72420000 "GoToResolveUnattended.exe" loaded module "MSI.DLL" at base 72030000 "GoToResolveUnattended.exe" loaded module "MSIMG32.DLL" at base 72020000 "GoToResolveUnattended.exe" loaded module "NETAPI32.DLL" at base 72000000 "GoToResolveUnattended.exe" loaded module "NTDLL.DLL" at base 77840000 "GoToResolveUnattended.exe" loaded module "OLE32.DLL" at base 75f30000 "GoToResolveUnattended.exe" loaded module "OLEAUT32.DLL" at base 774f0000 "GoToResolveUnattended.exe" loaded module "PDH.DLL" at base 74110000 "GoToResolveUnattended.exe" loaded module "POWRPROF.DLL" at base 769f0000 "GoToResolveUnattended.exe" loaded module "PSAPI.DLL" at base 76ad0000 "GoToResolveUnattended.exe" loaded module "RPCRT4.DLL" at base 76390000 "GoToResolveUnattended.exe" loaded module "RSTRTMGR.DLL" at base 734b0000 "GoToResolveUnattended.exe" loaded module "SAS.DLL" at base 71fd0000 "GoToResolveUnattended.exe" loaded module "SECUR32.DLL" at base 71fc0000 "GoToResolveUnattended.exe" loaded module "SETUPAPI.DLL" at base 76540000 "GoToResolveUnattended.exe" loaded module "SHELL32.DLL" at base 74850000 "GoToResolveUnattended.exe" loaded module "SHLWAPI.DLL" at base 76970000 "GoToResolveUnattended.exe" loaded module "SLWGA.DLL" at base 71fa0000 "GoToResolveUnattended.exe" loaded module "USER32.DLL" at base 76f40000 "GoToResolveUnattended.exe" loaded module "USERENV.DLL" at base 71f50000 "GoToResolveUnattended.exe" loaded module "UXTHEME.DLL" at base 73d10000 "GoToResolveUnattended.exe" loaded module "VERSION.DLL" at base 73f90000 "GoToResolveUnattended.exe" loaded module "WINHTTP.DLL" at base 71ea0000 "GoToResolveUnattended.exe" loaded module "WINMM.DLL" at base 71e70000 "GoToResolveUnattended.exe" loaded module "WS2_32.DLL" at base 76b90000 "GoToResolveUnattended.exe" loaded module "WTSAPI32.DLL" at base 73ed0000 "GoToResolveUnattended.exe" loaded module "WINTRUST.DLL" at base 76090000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76090000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71ca0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76170000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76110000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71c50000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 71c50000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71c20000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73510000 "GoToResolveUnattended.exe" loaded module "SSPICLI.DLL" at base 74260000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71bb0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71b60000 "GoToResolveUnattended.exe" loaded module "CRYPTNET.DLL" at base 71c50000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71b40000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 776f0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 76ad0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76970000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76c00000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 726c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 73ed0000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\PASSWORDPRIVACYDLL.DLL" at base 71a30000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d50000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d50000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d50000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\MEDIACLIENTLIB.DLL" at base 70a90000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\FILEMANAGER.DLL" at base 6f610000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75d50000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBCRYPTO-3.DLL" at base 6f1b0000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBSSL-3.DLL" at base 6f090000 "GoToResolveUnattended.exe" loaded module "WSOCK32.DLL" at base 6dc60000 "GoToResolveUnattended.exe" loaded module "SHCORE.DLL" at base 76a40000 "GoToResolveUnattended.exe" loaded module "SNMPAPI.DLL" at base 6dc50000 "GoToResolveUnattended.exe" loaded module "INETMIB1.DLL" at base 6dc40000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBGOTORESOLVE.DLL" at base 6dce0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d10000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77590000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76c00000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73440000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73420000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73400000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 733f0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74850000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737b0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 732c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74850000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73b50000 "GoToResolveUnattended.exe" loaded module "MSISO.DLL" at base 73260000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75d50000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74280000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741b0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 730c0000 "cmd.exe" loaded module "KERNEL32" at base 776f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d50000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75c50000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d50000 "cmd.exe" loaded module "KERNEL32.DLL" at base 776f0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77840000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "KERNEL32" at base 776f0000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "ADVAPI32.DLL" at base 76c00000 "GoToResolveProcessChecker.exe" loaded module "AVRT.DLL" at base 73040000 "GoToResolveProcessChecker.exe" loaded module "BCRYPT.DLL" at base 735e0000 "GoToResolveProcessChecker.exe" loaded module "CRYPT32.DLL" at base 76170000 "GoToResolveProcessChecker.exe" loaded module "D2D1.DLL" at base 72b30000 "GoToResolveProcessChecker.exe" loaded module "GDI32.DLL" at base 769c0000 "GoToResolveProcessChecker.exe" loaded module "D3D11.DLL" at base 728f0000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776f0000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "DBGHELP.DLL" at base 726c0000 "GoToResolveProcessChecker.exe" loaded module "DWMAPI.DLL" at base 73160000 "GoToResolveProcessChecker.exe" loaded module "DWRITE.DLL" at base 72440000 "GoToResolveProcessChecker.exe" loaded module "DXGI.DLL" at base 72850000 "GoToResolveProcessChecker.exe" loaded module "GDIPLUS.DLL" at base 73fa0000 "GoToResolveProcessChecker.exe" loaded module "IMM32.DLL" at base 75c50000 "GoToResolveProcessChecker.exe" loaded module "IPHLPAPI.DLL" at base 74180000 "GoToResolveProcessChecker.exe" loaded module "KERNEL32.DLL" at base 776f0000 "GoToResolveProcessChecker.exe" loaded module "MPR.DLL" at base 74160000 "GoToResolveProcessChecker.exe" loaded module "MSDMO.DLL" at base 72420000 "GoToResolveProcessChecker.exe" loaded module "MSI.DLL" at base 72030000 "GoToResolveProcessChecker.exe" loaded module "MSIMG32.DLL" at base 72020000 "GoToResolveProcessChecker.exe" loaded module "NETAPI32.DLL" at base 72000000 "GoToResolveProcessChecker.exe" loaded module "NTDLL.DLL" at base 77840000 "GoToResolveProcessChecker.exe" loaded module "OLE32.DLL" at base 75f30000 "GoToResolveProcessChecker.exe" loaded module "OLEAUT32.DLL" at base 774f0000 "GoToResolveProcessChecker.exe" loaded module "PDH.DLL" at base 74110000 "GoToResolveProcessChecker.exe" loaded module "POWRPROF.DLL" at base 769f0000 "GoToResolveProcessChecker.exe" loaded module "PSAPI.DLL" at base 76ad0000 "GoToResolveProcessChecker.exe" loaded module "RPCRT4.DLL" at base 76390000 "GoToResolveProcessChecker.exe" loaded module "RSTRTMGR.DLL" at base 734b0000 "GoToResolveProcessChecker.exe" loaded module "SAS.DLL" at base 71fd0000 "GoToResolveProcessChecker.exe" loaded module "SECUR32.DLL" at base 71fc0000 "GoToResolveProcessChecker.exe" loaded module "SETUPAPI.DLL" at base 76540000 "GoToResolveProcessChecker.exe" loaded module "SHELL32.DLL" at base 74850000 "GoToResolveProcessChecker.exe" loaded module "SHLWAPI.DLL" at base 76970000 "GoToResolveProcessChecker.exe" loaded module "SLWGA.DLL" at base 71fa0000 "GoToResolveProcessChecker.exe" loaded module "USER32.DLL" at base 76f40000 "GoToResolveProcessChecker.exe" loaded module "USERENV.DLL" at base 71f50000 "GoToResolveProcessChecker.exe" loaded module "UXTHEME.DLL" at base 73d10000 "GoToResolveProcessChecker.exe" loaded module "VERSION.DLL" at base 73f90000 "GoToResolveProcessChecker.exe" loaded module "WINHTTP.DLL" at base 71ea0000 "GoToResolveProcessChecker.exe" loaded module "WINMM.DLL" at base 71e70000 "GoToResolveProcessChecker.exe" loaded module "WS2_32.DLL" at base 76b90000 "GoToResolveProcessChecker.exe" loaded module "WTSAPI32.DLL" at base 73ed0000 "GoToResolveProcessChecker.exe" loaded module "WINTRUST.DLL" at base 76090000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76090000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71ca0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76170000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76110000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71c50000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 71c50000 "GoToResolveProcessChecker.exe" loaded module "CRYPTNET.DLL" at base 71c50000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 776f0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 76ad0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76970000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76c00000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 726c0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 73ed0000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\PASSWORDPRIVACYDLL.DLL" at base 71a30000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\MEDIACLIENTLIB.DLL" at base 70a90000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\FILEMANAGER.DLL" at base 6f610000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75d50000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBCRYPTO-3.DLL" at base 6f1b0000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBSSL-3.DLL" at base 6f090000 "GoToResolveProcessChecker.exe" loaded module "WSOCK32.DLL" at base 6dc60000 "GoToResolveProcessChecker.exe" loaded module "SHCORE.DLL" at base 76a40000 "GoToResolveProcessChecker.exe" loaded module "SNMPAPI.DLL" at base 6dc50000 "GoToResolveProcessChecker.exe" loaded module "INETMIB1.DLL" at base 6dc40000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\3506702571605499921\LIBGOTORESOLVE.DLL" at base 6dce0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d10000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77590000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75c50000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 730a0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73510000 "GoToResolveProcessChecker.exe" loaded module "SSPICLI.DLL" at base 74260000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71bb0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71b60000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76c00000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74850000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73720000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73440000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73420000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73400000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 733f0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 736c0000 "GoToResolveProcessChecker.exe" loaded module "NTMARTA.DLL" at base 736c0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 741b0000 "GoToResolveCrashHandler.exe" loaded module "KERNEL32" at base 776f0000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75d50000 "GoToResolveCrashHandler.exe" loaded module "ADVAPI32.DLL" at base 76c00000 "GoToResolveCrashHandler.exe" loaded module "USER32.DLL" at base 76f4000050:T1784,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3-x64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libssl-3-x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3-x64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveTools64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools64.exe" was detected as "Microsoft Linker" and name: "Linker" "PasswordPrivacyDll.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PasswordPrivacyDll.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PasswordPrivacyDll.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveTools32.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools32.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools32.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnlock64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveCrashHandler.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveCrashHandler.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveCrashHandler.exe" was detected as "Microsoft Linker" and name: "Linker" "legacy.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "legacy.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "legacy.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnlock32.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock32.dll" was detected as "Microsoft Linker" and name: "Linker" "LMISupport7x64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "LMISupport7x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "LMISupport7x64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveProcessChecker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveProcessChecker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveProcessChecker.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveLoggerProcess.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveLoggerProcess.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveLoggerProcess.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveRemoteControl.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRemoteControl.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRemoteControl.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattendedUi.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedUi.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedUi.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattended.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattended.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattended.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattendedRemover.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedRemover.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedRemover.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveExternalModuleHandler.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveExternalModuleHandler.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveExternalModuleHandler.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveRegistryEditor.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRegistryEditor.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRegistryEditor.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveNetworkChecker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveNetworkChecker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveNetworkChecker.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveServiceManager.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveServiceManager.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveServiceManager.exe" was detected as "Microsoft Linker" and name: "Linker"51:T482,"GoToResolveUnattended.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "GoToResolveUnattended.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "GoToResolveUnattended.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "GoToResolveUnattended.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "GoToResolveUnattended.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "GoToResolveUnattended.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "GoToResolveUnattended.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "GoToResolveProcessChecker.exe" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")52:T74a,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3-x64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveTools64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "PasswordPrivacyDll.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveTools32.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnlock64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveCrashHandler.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "legacy.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnlock32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "LMISupport7x64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveProcessChecker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveLoggerProcess.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveRemoteControl.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattendedUi.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattended.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattendedRemover.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveExternalModuleHandler.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveRegistryEditor.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveNetworkChecker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveServiceManager.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"53:T642,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has an executable section named ".text" "libcrypto-3.dll" has an executable section named ".text" "libssl-3-x64.dll" has an executable section named ".text" "GoToResolveTools64.exe" has an executable section named ".text" "PasswordPrivacyDll.dll" has an executable section named ".text" "PasswordPrivacyDll.dll" has an executable section named ".orpc" "libssl-3.dll" has an executable section named ".text" "GoToResolveTools32.exe" has an executable section named ".text" "GoToResolveUnlock64.dll" has an executable section named ".text" "GoToResolveCrashHandler.exe" has an executable section named ".text" "legacy.dll" has an executable section named ".text" "GoToResolveUnlock32.dll" has an executable section named ".text" "LMISupport7x64.dll" has an executable section named ".text" "GoToResolveProcessChecker.exe" has an executable section named ".text" "GoToResolveLoggerProcess.exe" has an executable section named ".text" "GoToResolveRemoteControl.exe" has an executable section named ".text" "GoToResolveUnattendedUi.exe" has an executable section named ".text" "GoToResolveUnattended.exe" has an executable section named ".text" "GoToResolveUnattendedRemover.exe" has an executable section named ".text" "GoToResolveExternalModuleHandler.exe" has an executable section named ".text" "GoToResolveRegistryEditor.exe" has an executable section named ".text" "GoToResolveNetworkChecker.exe" has an executable section named ".text" "GoToResolveServiceManager.exe" has an executable section named ".text"54:T677,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has an writable section named ".data" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has an writable section named "CPADinfo" "libcrypto-3.dll" has an writable section named ".data" "libcrypto-3.dll" has an writable section named ".fptable" "libssl-3-x64.dll" has an writable section named ".data" "libssl-3-x64.dll" has an writable section named ".fptable" "libssl-3-x64.dll" has an writable section named "_guard_c" "libssl-3-x64.dll" has an writable section named "_guard_d" "GoToResolveTools64.exe" has an writable section named ".data" "PasswordPrivacyDll.dll" has an writable section named ".data" "PasswordPrivacyDll.dll" has an writable section named ".tls" "libssl-3.dll" has an writable section named ".data" "libssl-3.dll" has an writable section named ".fptable" "GoToResolveTools32.exe" has an writable section named ".data" "GoToResolveUnlock64.dll" has an writable section named ".data" "GoToResolveCrashHandler.exe" has an writable section named ".data" "GoToResolveCrashHandler.exe" has an writable section named "CPADinfo" "GoToResolveCrashHandler.exe" has an writable section named ".fptable" "legacy.dll" has an writable section named ".data" "legacy.dll" has an writable section named ".fptable" "GoToResolveUnlock32.dll" has an writable section named ".data" "LMISupport7x64.dll" has an writable section named ".data" "LMISupport7x64.dll" has an writable section named ".tls" "GoToResolveProcessChecker.exe" has an writable section named ".data" "GoToResolveLoggerProcess.exe" has an writable section named ".data"55:T2de3,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" file has an entrypoint instructions - "call 0x4dd899,jmp 0x4dc8b2,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push -1,push 0x517ccc,mov eax, dword ptr fs:[0],push eax,push ecx,push ebx,push esi,push edi,mov eax, dword ptr [0x55d440],xor eax, ebp,push eax,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,mov dword ptr [ebp - 0x10], esp,push dword ptr [ebp + 8],and dword ptr [ebp - 4], 0,call 0x4dc767,pop ecx,jmp 0x4dca80,mov eax, 0x4dca7e,ret ,xor eax, eax,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop esi,pop ebx,leave ,ret ,int3 ,int3 ,int3 ,int3 ," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x102af2fe,jmp 0x102bb838,jmp 0x1021d800,jmp 0x101b5fa0,jmp 0x100b1b50,jmp 0x10095240,jmp 0x102ffbee,jmp 0x102adb30,jmp 0x10127ef0,jmp 0x101e6a40,jmp 0x10249fa0,jmp 0x1013d4a0,jmp 0x100efe20,jmp 0x1031f746,jmp 0x102cd7a3,jmp 0x10100130,jmp 0x1009cd80,jmp 0x1016a800,jmp 0x10102a20,jmp 0x101cd000," "libssl-3-x64.dll" file has an entrypoint instructions - "jmp 0x1800847b8,jmp 0x1800e66f8,jmp 0x180024970,jmp 0x18002a4c0,jmp 0x1800c93b8,jmp 0x1800bbb5c,jmp 0x18000fad0,jmp 0x1800a1138,jmp 0x180091ea4,jmp 0x1800a8504,jmp 0x1800a629c,jmp 0x1800a85e8,jmp 0x18006b990,jmp 0x1800cced4,jmp 0x180035f80,jmp 0x180085190,jmp 0x180091ed0,jmp 0x18007acf0,jmp 0x180018780,jmp 0x1800d7c94," "GoToResolveTools64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400bab60,add rsp, 0x28,jmp 0x1400b9cac,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov edx, 0xfa0,lea rcx, [rip + 0x826de],call qword ptr [rip + 0x3d5f8],lea rcx, [rip + 0x45649],call qword ptr [rip + 0x3d323],mov rbx, rax,test rax, rax,jne 0x1400b9e7a,lea rcx, [rip + 0x3f75c],call qword ptr [rip + 0x3d30e],mov rbx, rax,test rax, rax,je 0x1400b9ef9,lea rdx, [rip + 0x45667],mov rcx, rbx," "PasswordPrivacyDll.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100a2e43,call 0x100ad7d1,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100a2e58,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x1010b140,call 0x100a58f0,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100a2e7a,cmp dword ptr [0x101122bc], esi,je 0x100a2f5e,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100a2e88,cmp esi, 2,jne 0x100a2ebd,mov ecx, dword ptr [0x10109860],test ecx, ecx,je 0x100a2e9e,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x10072f1c,jmp 0x1007ec68,jmp 0x100a9d23,jmp 0x10049650,jmp 0x10023ec0,jmp 0x10053c50,jmp 0x10057c20,jmp 0x100c7300,jmp 0x10092b0d,jmp 0x1002b8b0,jmp 0x10024050,jmp 0x1008c636,jmp 0x100a9098,jmp 0x100a4bc6,jmp 0x10073028,jmp 0x100d1fc0,jmp 0x10088af7,jmp 0x100a5826,jmp 0x100aff48,jmp 0x1003eac0," "GoToResolveTools32.exe" file has an entrypoint instructions - "call 0x49ce49,jmp 0x49bcf4,jmp 0x49bbf9,call 0x49bea6,push 0,call 0x49c137,pop ecx,test al, al,je 0x49be9e,push 0x49bf28,call 0x49c2c4,pop ecx,xor eax, eax,ret ,push 7,call 0x49cf00,int3 ,push esi,push edi,push 0xfa0,push 0x504b7c,call dword ptr [0x4d3224],push 0x4d9818,call dword ptr [0x4d30c0],mov esi, eax,test esi, esi,jne 0x49beda,push 0x4d482c,call dword ptr [0x4d30c0]," "GoToResolveUnlock64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180055141,call 0x180055aa8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180054fec,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x180055180,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx," "GoToResolveCrashHandler.exe" file has an entrypoint instructions - "call 0x443c9b,jmp 0x442e6f,call 0x44301c,push 0,call 0x443809,pop ecx,test al, al,je 0x443014,push 0x44309e,call 0x443996,pop ecx,xor eax, eax,ret ,push 7,call 0x443d55,int3 ,push esi,push edi,push 0xfa0,push 0x49b27c,call dword ptr [0x475038],push 0x4831a8,call dword ptr [0x475000],mov esi, eax,test esi, esi,jne 0x443050,push 0x4752fc,call dword ptr [0x475000],mov esi, eax,test esi, esi," "legacy.dll" file has an entrypoint instructions - "jmp 0x1001728d,jmp 0x100229a8,jmp 0x10026275,jmp 0x10016a40,jmp 0x10066205,jmp 0x100339ec,jmp 0x1002d515,jmp 0x100255ea,jmp 0x1004613a,jmp 0x100173b0,jmp 0x1006fb70,jmp 0x10029995,jmp 0x10046e72,jmp 0x10058173,jmp 0x1004bbb4,jmp 0x10030b77,jmp 0x10057b13,jmp 0x100231d8,jmp 0x10034c4d,jmp 0x1004193c," "GoToResolveUnlock32.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003de5e,call 0x1003e83a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003dd1a,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x1003de99,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10," "LMISupport7x64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013db1,call 0x180014464,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180013c40,int3 ,int3 ,int3 ,and dword ptr [rip + 0x54555], 0,ret ,mov qword ptr [rsp + 8], rbx,push rbp,lea rbp, [rsp - 0x4c0],sub rsp, 0x5c0,mov ebx, ecx,mov ecx, 0x17," "GoToResolveProcessChecker.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveLoggerProcess.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveRemoteControl.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveUnattendedUi.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveUnattended.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveUnattendedRemover.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveExternalModuleHandler.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveRegistryEditor.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveNetworkChecker.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveServiceManager.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc,"56:Tb9b,Process "GoToResolveUnattended.exe" (UID: 00000000-00000836) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveUnattended.exe" (UID: 00000000-00000836) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "timeout.exe" (UID: 00000000-00006128) was launched with new environment variables: "PROMPT="$P$G", self="C:\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd"" Process "timeout.exe" (UID: 00000000-00006196) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", self="C:\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd"" Process "timeout.exe" (UID: 00000000-00006196) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00005716) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00005716) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00001428) was launched with new environment variables: "SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console"" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00001428) was launched with modified environment variables: "Path" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00006496) was launched with new environment variables: "SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", USERDNSDOMAIN="WORKGROUP", PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00006496) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "GoToResolveUnattended.exe" (UID: 00000000-00001056) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, Path, NUMBER_OF_PROCESSORS" Process "GoToResolveUnattended.exe" (UID: 00000000-00001056) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432"57:T80e,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "GoToResolveProcessChecker.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GoToResolveProcessChecker.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoToResolveProcessChecker.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")58:T40b,Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000836-00000C2A-1872174862] Observed system executable string:"%WINDIR%\system32\PSAPI.DLL" [Source: 00000000-00000836-00000C2A-1872218025] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00000836-00000C2A-1872255848] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00000836-00000C2A-1872294947] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00000836-00000C2A-1872371418] Observed system executable string:"%WINDIR%\system32\dbghelp.dll" [Source: 00000000-00000836-00000C2A-1872448663] Observed system executable string:"%WINDIR%\system32\wtsapi32.dll" [Source: 00000000-00000836-00000C2A-1872485979] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00000836-00000C2A-1878801194] Observed system executable string:"%WINDIR%\system32\ntmarta.dll" [Source: 00000000-00001428-00000C2A-1898964059]59:T478,Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00000836) Spawned process "cmd.exe" with commandline "/S /C ""C:\\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da971 ..." (UID: 00000000-00003180) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006128) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006196) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00007452) Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 836 -InstallationId YfAqG129TJ ..." (UID: 00000000-00005716) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00001428), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506 ..." (UID: 00000000-00006496) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "1428" "-Installatio ..." (UID: 00000000-00001056)5a:T478,Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00000836) Spawned process "cmd.exe" with commandline "/S /C ""C:\\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da971 ..." (UID: 00000000-00003180) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006128) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006196) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00007452) Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 836 -InstallationId YfAqG129TJ ..." (UID: 00000000-00005716) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00001428), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506 ..." (UID: 00000000-00006496) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "1428" "-Installatio ..." (UID: 00000000-00001056)5b:T48b,The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 6D:C2:5E:62:60:6D:15:24:7E:1D:6E:B1:C7:A4:0E:C9:8A:03:FC:10; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 8D:3F:A6:EE:EB:FC:68:A0:FA:76:CD:C4:C6:AD:59:82:FE:07:DE:91; see report for more information)5c:T6b1,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libcrypto-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PasswordPrivacyDll.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libssl-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveTools32.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveCrashHandler.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "legacy.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnlock32.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveProcessChecker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveLoggerProcess.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveRemoteControl.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattendedUi.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattended.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattendedRemover.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveExternalModuleHandler.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveRegistryEditor.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveNetworkChecker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveServiceManager.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE5d:T676,file/memory contains long string(Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions" (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Outlook Attachment" (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator." (Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "ystem.IsAttachment" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "ystem.Message.AttachmentContents" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "ystem.Message.AttachmentNames" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "ystem.Message.HasAttachments" (Source: "00000000-00000836.00000001.185126.06830000.00000002.mdmp") Found string "System.IsAttachment" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp") Found string "System.Message.AttachmentContents" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp") Found string "System.Message.AttachmentNames" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp") Found string "System.Message.HasAttachments" (Source: "00000000-00000836.00000001.185126.06890000.00000002.mdmp")5e:T863,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "748" "BaseAddress": "00BBF1E8" "Buffer": "0233A890" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\GoToResolveUnattended.exe"} "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "752" "BaseAddress": "009D01E8" "Buffer": "02339FC0" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\cmd.exe"} "GoToResolveUnattended.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2400" "BaseAddress": "005E21E8" "Buffer": "0680EC28" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\GoToResolveProcessChecker.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "436" "BaseAddress": "008551E8" "Buffer": "00B3DD70" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\timeout.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "428" "BaseAddress": "00B561E8" "Buffer": "00B3DD70" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\timeout.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "436" "BaseAddress": "010E01E8" "Buffer": "00B3DD70" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\timeout.exe"} "GoToResolveProcessChecker.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2084" "BaseAddress": "00AD01E8" "Buffer": "04F4DD20" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\GoToResolveCrashHandler.exe"} "GoToResolveProcessChecker.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2324" "BaseAddress": "005551E8" "Buffer": "04F4CA78" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\GoToResolveUnattended.exe"}5f:T3618,"LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll]- [targetUID: 00000000-00005716] "libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3-x64.dll]- [targetUID: 00000000-00004728] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll]- [targetUID: 00000000-00005716] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll]- [targetUID: 00000000-00005716] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll]- [targetUID: 00000000-00005716] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3-x64.dll]- [targetUID: 00000000-00004728] "GoToResolveTools64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools64.exe]- [targetUID: 00000000-00004728] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll]- [targetUID: 00000000-00005716] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll]- [targetUID: 00000000-00005716] "GoToResolveTools32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools32.exe]- [targetUID: 00000000-00004728] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004728] "GoToResolveCrashHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveCrashHandler.exe]- [targetUID: 00000000-00004728] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\legacy.dll]- [targetUID: 00000000-00004728] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004728] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x64.dll]- [targetUID: 00000000-00004728] "GoToResolveProcessChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveProcessChecker.exe]- [targetUID: 00000000-00005716] "GoToResolveLoggerProcess.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveLoggerProcess.exe]- [targetUID: 00000000-00004728] "GoToResolveRemoteControl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRemoteControl.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattendedUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedUi.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattended.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattendedRemover.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedRemover.exe]- [targetUID: 00000000-00004728] "GoToResolveExternalModuleHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveExternalModuleHandler.exe]- [targetUID: 00000000-00004728] "GoToResolveRegistryEditor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRegistryEditor.exe]- [targetUID: 00000000-00004728] "GoToResolveNetworkChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveNetworkChecker.exe]- [targetUID: 00000000-00004728] "GoToResolveServiceManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveServiceManager.exe]- [targetUID: 00000000-00004728] "GoToResolveFileManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveFileManager.exe]- [targetUID: 00000000-00004728] "GoToResolveQuickView.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveQuickView.exe]- [targetUID: 00000000-00004728] "GoToResolveTerminal.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTerminal.exe]- [targetUID: 00000000-00004728] "GoToResolveUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUi.exe]- [targetUID: 00000000-00004728] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x32.dll]- [targetUID: 00000000-00004728] "LMISupportM64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM64.exe]- [targetUID: 00000000-00004728] "LMISupportM32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM32.exe]- [targetUID: 00000000-00004728] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook64.dll]- [targetUID: 00000000-00004728] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook32.dll]- [targetUID: 00000000-00004728] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook64.dll]- [targetUID: 00000000-00004728] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook64.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.dll]- [targetUID: 00000000-00004728] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook32.dll]- [targetUID: 00000000-00004728] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook32.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.dll]- [targetUID: 00000000-00004728] "g2rvdd.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.cat]- [targetUID: 00000000-00004728] "g2rvdd.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.cat]- [targetUID: 00000000-00004728] "UnattendedUpdater.csv" has type "ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv]- [targetUID: 00000000-00004728] "g2rvdd.inf" has type "Windows setup INFormation"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.inf]- [targetUID: 00000000-00004728] "g2rvdd.inf" has type "Windows setup INFormation"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.inf]- [targetUID: 00000000-00004728] "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [C:\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd]- [targetUID: 00000000-00003180] "GoToResolveProcessChecker.log" has type "ASCII text with CRLF LF line terminators"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\GoToResolveProcessChecker.log]- [targetUID: 00000000-00005716] "UnattendedUpdater.log" has type "ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log]- [targetUID: 00000000-00004728] "GoToResolveUnattended.log" has type "ASCII text with CRLF LF line terminators"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\GoToResolveUnattended.log]- [targetUID: 00000000-00000836] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716] "unattended.json" has type "JSON text data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\unattended.json]- [targetUID: 00000000-00005716] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716] "session.json" has type "JSON text data"- [targetUID: N/A] "settings.dat" has type "data"- [targetUID: 00000000-00001428] "settings.dat" has type "data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\appdata\ProcessCheckerCrashReportDB\settings.dat]- [targetUID: 00000000-00001428] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: 00000000-00004728] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716]60:T851,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")61:T12cd,"LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll]- [targetUID: 00000000-00005716] "libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3-x64.dll]- [targetUID: 00000000-00004728] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll]- [targetUID: 00000000-00005716] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll]- [targetUID: 00000000-00005716] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll]- [targetUID: 00000000-00005716] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3-x64.dll]- [targetUID: 00000000-00004728] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll]- [targetUID: 00000000-00005716] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll]- [targetUID: 00000000-00005716] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004728] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\legacy.dll]- [targetUID: 00000000-00004728] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004728] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x64.dll]- [targetUID: 00000000-00004728] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x32.dll]- [targetUID: 00000000-00004728] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook64.dll]- [targetUID: 00000000-00004728] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook32.dll]- [targetUID: 00000000-00004728] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook64.dll]- [targetUID: 00000000-00004728] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook64.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.dll]- [targetUID: 00000000-00004728] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook32.dll]- [targetUID: 00000000-00004728] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook32.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.dll]- [targetUID: 00000000-00004728] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: 00000000-00004728]62:T109f,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "6F980CF9CBEEE09B45BB913DDDA8159A30F1C285AC0BCF0DA9717FF6E0E49CF8.EXE"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "6F980CF9CBEEE09B45BB913DDDA8159A30F1C285AC0BCF0DA9717FF6E0E49CF8"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")63:T403,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" reads file "c:\program files (x86)\goto resolve unattended\3506702571605499921\unattended.json" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" reads file "c:\windows\fonts\staticcache.dat" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\3506702571605499921\passwordprivacydll.dll" "GoToResolveUnattended.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8ec9b1d0abbd7f98b401d425828828ce_1b47b234e9558c0145847e653cbeced5" "GoToResolveUnattended.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\0e0ea2cd61f757ceb5bb65fc2c758bf4_59b8c30534ea03831ad62b87d9d5f56a" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\3506702571605499921\mediaclientlib.dll" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\3506702571605499921\filemanager.dll"64:T4b5,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to detect virtual environment Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Possibly tries to evade analysis by sleeping many times Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to delay the execution of current thread65:T631,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\RSTRTMGR.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\SysWOW64\RstrtMgr.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\NCRYPT.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\SysWOW64\ncrypt.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\BCRYPT.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\NTASN1.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\SysWOW64\ntasn1.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\6F980CF9CBEEE09B45BB913DDDA8159A30F1C285AC0BCF0DA9717FF6E0E49CF8.EXE.LOCAL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll"66:T114c,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\unattended.json" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveProcessChecker.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUi.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveLoggerProcess.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRemoteControl.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedUi.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedRemover.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveNetworkChecker.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveQuickView.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveFileManager.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTerminal.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveServiceManager.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveExternalModuleHandler.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRegistryEditor.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.cat" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.inf" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.cat" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.inf" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook32.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook64.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook32.dll"67:Tb12,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\NCRYPT.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\BCRYPT.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\NTASN1.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\CMD.EXE" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\cmd.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "cmd.exe" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\DPAPI.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\DPAPI.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\DUSER.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\DUser.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\IMAGERES.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\imageres.dll" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "GoToResolveUnattended.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "GoToResolveUnattended.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\FLTLIB.DLL" "GoToResolveUnattended.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\CRYPTSP.DLL" "GoToResolveUnattended.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "GoToResolveUnattended.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll"68:T8ab,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7" (Indicator: "InternetOpen"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8" (Indicator: "InternetConnect"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13" (Indicator: "HttpOpenRequest"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "WSAStartup"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")69:T5b8,Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "void __cdecl crashpad::`anonymous-namespace'::CreatePipe(class std::basic_string,class std::allocator > *,class base::ScopedGeneric *)" (Indicator: "CreatePipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "AppendData (or AddSubdirectory or CreatePipeInstance)" (Indicator: "CreatePipe"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")6a:T744,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp")6b:T11a2,Found reference to API "gethostname" (Indicator: "gethostname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "ed to send ${0}." (Indicator: " send "; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Unable to send control message to service, error=%lu" (Indicator: " send "; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "Can not set property at runtime.rCan't move focus to the control because it is invisible, not enabled, or of a type that does not accept the focus." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "and will send the form data without encrypting it for privacy." (Indicator: " send "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") file/memory contains long string with (Indicator: " listen "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "CIM datetime type does not accept more than 99999999 days." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "and it tried to send again the message, but the configuration changed and the new settings did not allow the message to be re-sent." (Indicator: " send "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "Create a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "Created a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The Windows Remote Shell cannot process the request. The WS-Addressing action URI is invalid. The valid actions are Command, Receive, Send and Signal." (Indicator: " send "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WS-Management service cannot accept subscriptions to an indication class, when either the filter or the dialect is specified." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WS-Management service cannot complete the request because the receiver does not accept the delivery of events." (Indicator: " accept "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")6c:T7cc,"2.5.29.37" "2.5.29.35" "2.5.29.31" Potential IP "1.2.13.1" found in string "1.2.13.1-motley" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.15" "2.5.29.32" "2.5.29.17" "2.5.29.1" "2.5.4.15" "2.5.4.5" "2.5.4.6" "2.5.4.8" "2.5.29.10" "2.5.4.3" "2.5.4.7" "2.5.4.10" "2.5.29.16" "192.168.0.2" "1.3.101.110" "1.3.101.111" "1.3.101.112" "1.3.101.113" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"6d:T4046,Pattern match: "https://dumpster.console.gotoresolve.com/api/dump" Heuristic match: "../../client/crashpad_client_win.cc" Heuristic match: "../../client/settings.cc" Heuristic match: "../../client/crash_report_database_win.cc" Heuristic match: "../../util/win/scoped_handle.cc" Heuristic match: "../../util/win/critical_section_with_debug_info.cc" Heuristic match: "../../util/win/registration_protocol_win.cc" Heuristic match: "../../util/file/file_io.cc" Heuristic match: "../../util/file/file_io_win.cc" Heuristic match: "../../util/file/file_writer.cc" Heuristic match: "../../util/file/directory_reader_win.cc" Heuristic match: "../../util/file/filesystem_win.cc" Heuristic match: "../../util/file/file_reader.cc" Heuristic match: "../../util/win/scoped_local_alloc.cc" Heuristic match: "../../third_party/mini_chromium/mini_chromium/base/rand_util.cc" Pattern match: "l.goto.com/!&b" Heuristic match: "lg>.lb" Pattern match: "https://dumpster.console.gotoresolve.com" Pattern match: "https://dumpster.dev01-console.gotoresolve.com" Pattern match: "https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392#bkmk_easy" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0u{gloygc:f8l;_?{@*42r9farwashington1redmond1microsoft" Pattern match: "https://applet.console.gotoresolve.comapplicationtype" Pattern match: "https://devices-iot.console.gotoresolve.com/,companyid:3506702571605499921,product:6,loglevel:2,offline:0,fleettemplatename:syn-prd-ava-unattended,namespace:syn-prd-ava-unattended,healthcheckurl:https://devices.console.gotoresolve" Heuristic match: "devices.console.gotoresolve.com" Heuristic match: "devices-iot.console.gotoresolve.com" Heuristic match: "ocsp.digicert.com" Heuristic match: "../../util/win/module_version.cc" Heuristic match: "../../util/process/process_memory_range.cc" Heuristic match: "../../util/process/process_memory.cc" Heuristic match: "../../util/process/process_memory_win.cc" Heuristic match: "../../util/win/process_info.cc" Heuristic match: "../../client/prune_crash_reports.cc" Heuristic match: "../../util/net/http_body_gzip.cc" Heuristic match: "../../util/net/http_transport_win.cc" Heuristic match: "../../util/net/http_multipart_builder.cc" Heuristic match: "../../snapshot/win/pe_image_resource_reader.cc" Heuristic match: "../../snapshot/win/process_subrange_reader.cc" Heuristic match: "../../snapshot/win/pe_image_reader.cc" Heuristic match: "../../snapshot/win/pe_image_annotations_reader.cc" Heuristic match: "../../snapshot/crashpad_types/crashpad_info_reader.cc" Heuristic match: "../../snapshot/win/cpu_context_win.cc" Heuristic match: "../../snapshot/capture_memory.cc" Heuristic match: "../../util/file/file_seeker.cc" Heuristic match: "../../snapshot/minidump/minidump_simple_string_dictionary_reader.cc" Heuristic match: "../../snapshot/minidump/system_snapshot_minidump.cc" Heuristic match: "../../snapshot/minidump/module_snapshot_minidump.cc" Heuristic match: "../../snapshot/win/system_snapshot_win.cc" Heuristic match: "../../snapshot/win/module_snapshot_win.cc" Heuristic match: "../../snapshot/win/exception_snapshot_win.cc" Heuristic match: "../../snapshot/cpu_context.cc" Heuristic match: "../../snapshot/win/process_reader_win.cc" Heuristic match: "../../snapshot/memory_snapshot.cc" Heuristic match: "../../snapshot/minidump/process_snapshot_minidump.cc" Heuristic match: "../../snapshot/minidump/minidump_annotation_reader.cc" Heuristic match: "../../snapshot/minidump/minidump_string_list_reader.cc" Heuristic match: "../../snapshot/win/process_snapshot_win.cc" Heuristic match: "../../minidump/minidump_writer_util.cc" Heuristic match: "../../minidump/minidump_context_writer.cc" Heuristic match: "../../minidump/minidump_module_writer.cc" Heuristic match: "../../minidump/minidump_memory_writer.cc" Heuristic match: "../../minidump/minidump_exception_writer.cc" Heuristic match: "../../minidump/minidump_writable.cc" Heuristic match: "../../minidump/minidump_file_writer.cc" Heuristic match: "../../minidump/minidump_system_info_writer.cc" Heuristic match: "../../client/crash_report_database.cc" Heuristic match: "../../util/synchronization/semaphore_win.cc" Heuristic match: "../../util/thread/thread_win.cc" Heuristic match: "../../util/win/scoped_process_suspend.cc" Heuristic match: "../../util/win/session_end_watcher.cc" Heuristic match: "../../util/win/scoped_set_event.cc" Heuristic match: "../../util/win/exception_handler_server.cc" Heuristic match: "../../util/win/initial_client_data.cc" Heuristic match: "../../util/misc/paths_win.cc" Heuristic match: "../../handler/minidump_to_upload_parameters.cc" Heuristic match: "../../handler/user_stream_data_source.cc" Heuristic match: "../../handler/crash_report_upload_thread.cc" Heuristic match: "../../handler/handler_main.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "../../handler/win/crash_report_exception_handler.cc" Heuristic match: "../../minidump/minidump_thread_writer.cc" Heuristic match: "../../minidump/minidump_unloaded_module_writer.cc" Heuristic match: "../../minidump/minidump_module_crashpad_info_writer.cc" Pattern match: "ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3d" Heuristic match: "ntrust.net" Heuristic match: "csp.digicert.com" Heuristic match: "ocsp.edge.digicert.com" Heuristic match: "cac-ocsp.digicert.com.edgekey.net" Pattern match: "http://ocsp.digicert.com" Pattern match: "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl" Pattern match: "https://secure.logmein.com0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "ert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://www.microsoft.com0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "https://secure.logmein.com" Pattern match: "www.digicert.com1.0" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00" Pattern match: "http://crl4.digicert.com/assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0l" Pattern match: "http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl07" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0k" Pattern match: "http://ocsp.digicert.com0h" Pattern match: "http://cacerts.digicert.com/digicertevcodesigningca-sha2.crt0" Pattern match: "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl" Heuristic match: "e3913.cd.akamaiedge.net" Pattern match: "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbrbuhdibvrw1t5r3wyz1c9jl6i%2ftwqu729tsunkbnx6yukqvvyv1ensy04ceaqa7xhljfefgthedqevdgg%3d" Pattern match: "www.digicert.com110/" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0p" Pattern match: "www.digicert.com/cps0d" Pattern match: "http://cacerts.digicp" Pattern match: "www.webrtc.org/experiments/rtp-hdrext/inband-cn" Heuristic match: "*{?.cu" Heuristic match: "g.ogzs.qa" Pattern match: "www.digice" Pattern match: "www.digi" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0j" Pattern match: "www.dil" Pattern match: "https://devices-" Pattern match: "https://applet.c" Heuristic match: "lve.com" Pattern match: "https://devices-iot.console.gotoresolve.com/" Pattern match: "https://custombranding.console.gotoresolve.com" Pattern match: "https://devices.console.gotoresolve.com/health" Pattern match: "https://sessions.console.gotoresolve.com" Pattern match: "https://devices-iot.console.gotoresolve.com/,sessionid" Pattern match: "crl3.digicert.com/digicerttr" Heuristic match: "ert.com" Pattern match: "https://applet.console.gotoresolve.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = 0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l4w90https://secure.logmein.comhttps://secure.logmein.com1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0=a5i-g[$;i[je.wzd?0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbrbuhdibvrw1t5r3wyz1c9jl6i%2ftwqu729tsunkbnx6yukqvvyv1ensy04ceaqa7xhljfefgthedqevdgg%3d1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found URL "https://secure.logmein.comaeeeh" - Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "https://secure.logmein.comhttps://secure.logmein.comhttps://secure.logmein.com1.2.840.113549.1.9.16.1.420250902090156zhttps://secure.logmein.com1.2.840.113549.1.9.16.1.420250902090156z1" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "https://secure.logmein.comdigicert" - Source: "00000000-00000836.00000000.183492.03055000.00000004.mdmp") Found URL "http://crl3.di0om/evcodesigningsha2-g1.41http://crl4.digicert.hdesigningsha2-g1.crl0j0)0'://www.digicert.com/cps0dr0p0$tp://ocsp.digicert.com0h\0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000000.183492.033D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000000.183492.033D0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000000.183492.033D0000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00000836.00000000.183492.033D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "https://secure.logmein.com0/" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00000836.00000000.183492.056A0000.00000004.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/inband-cnmbp?libvpxwebrtc-vp8-forced-fallback-encoder-v2webrtc-switchencoderoninitializationfailureswebrtc-framedropper" - Source: "00000000-00000836.00000000.183492.05C8C000.00000004.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/inband-cnmbp?libvpxwebrtc-vp8-forced-fallback-encoder-v2webrtc-switchencoderoninitializationfailureswebrtc-framedropper" - Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhyper-v" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crljbgurdgmcgguab7y7%2bf8u%2fvwty4:\windows\system32\dpapi.dllindows.ui.core.corewindow:\windows\system32\srvcli.dllotalnumberofpixelsgrabbed:\windows\syswow64\pku2u.dll:\windows\syswow64\tspkg.dll:\windows\system32\dnsapi.dll:\windows\system32\jsproxy.dllle0d42220b8837969912c418a0f2c4umberofgrabsfordiffpickerionwotalnumberofunsuccessfulgrabsumberofdiffpickerinvocationumberofpixelsinrawupdatesumberofpixelsdiffpickerfound:\windows\system32\snmpapi.dllation:\windows\system32\wsock32.dllurationofgrabsfordiffpickerurationofdiffpickeroperationam" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl3.eunattended-mqtt-permanent-fallbackunattended-new-updater-not-supportedunattended-migration-finished-failedunattended-remote-execution-finished-failedunattended-collect-support-files-successunattended-remote-execution-download-successfulunattended-mqtt-provisioning-doneunattended-migration-finished-successo84s[unattended-collect-support-files-startedunattended-collect-support-files-failedunattended-remote-execution-starting" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lfailed" - Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0jc0a060)0'http://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000001.185126.033D0000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120250902090157zdigicert," - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "https://secure.logmein.com01,m9g_r*s" - Source: "00000000-00000836.00000001.185126.056A0000.00000004.mdmp") Found URL "https://devices-console.gotoresolve.com/" - Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp") Found URL "https://applet.cle.ggiongtitle" - Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp") Found URL "https://cessionty" - Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/" - Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com" - Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health" - Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com" - Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/3506702571605499921fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/health0sessionbackendurl000000https://sessions.console.gotoresolve.com0000000appletgeneratorurl00000https://applet.console.gotoresolve.com0custombranding0custombrandingtitle0000custombrandingurl000000https://custombranding.console.gotoresolve.com0publickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1759417383677regiongloballangsessiontypeunattendedworkfoldersaltservicenamehostnameenvironmentproductionc:\program" - Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120250902090157zdigicert," - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrt" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c07https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.com" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthbdf9966be918cc369af9bbeddc6f0050syn-prd-ava-unattendedcyrpoftcx3lczkwxgotoresolve_3506702571605499921sessionbackendurlhttps://sessions.console.gotoresolve.comdevices-iot.console.gotoresolve.comc:\program" - Source: "00000000-00000836.00000001.185126.05D47000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg4.cr<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertarootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crjz/-5959%cnh.@c" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicertg4.crt0c2http://crl3.digicerdigicrust*s" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0.http://www.digicert.com/ssl-cps-repository.htm0:fk" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digrstedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4code:sa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp:bs.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "https://sbydigicert," - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4ppingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedroo<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicedidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrojz/-5fjitwz\t" - Source: "00000000-00000836.00000001.185126.064DB000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00000836.00000001.185126.6F19B000.00000002.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp") Found URL "https://l" - Source: "00000000-00001056.00000000.185582.00379000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00001056.00000000.185582.00379000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00001056.00000000.185582.00379000.00000002.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.1iwow20250902090157zdigicert," - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "https://secure.logmein.com0@8j" - Source: "00000000-00001056.00000000.185582.003E0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlare\microsoft\systemcertificates\trustedpublisher\physicalstoresha384microsoft" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl:\program" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0acacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1crt0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0i" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?]i" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwhypqi" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "https://secure.logmein.comrsa1rsa15vdez0o0m0k0i0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lhkv9appdata=c:\windows\system32\config\systemprofile\appdata\roamingasyclocalappdata=c:\windows\system32\config\systemprofile\appdata\localasycappdata=c:\windows\system32\config\systemprofile\appdata\roamingprocessor_identifier=intel64" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "https://secure.logmein.com/1(0&0$0" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "https://secure.logmein.com250902090157z1l0jhttps://secure.logmein.comjvx:hkv9t-6" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timeshkv9t!encdencdcommonprogramw6432=c:\program" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "https://secure.logmein.com0joe+y!" - Source: "00000000-00001056.00000000.185582.026B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001056.00000000.185582.02754000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001056.00000000.185582.02754000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120250902090156zdigicert," - Source: "00000000-00001056.00000000.185582.02754000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1." - Source: "00000000-00001056.00000000.185582.02754000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "https://secure.logmein.com0joe+y!" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "https://secure.logmein.com0@8j" - Source: "00000000-00001056.00000000.185582.04C90000.00000004.mdmp") Found URL "http://ocsp.digicert.com/ocsp.digicert.cometworkservicecryptographic" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl:\program" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120250902090159zdigicert," - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedrootg4.crl00" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@sg" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.60.2.1.2ahsmahsm1.3.6.1.4.1.311.60.2.1.3encdsecom" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2.23.140.1.4.2uj->do402asycasyccontextdllcreateobjectcontextasycschemedllretrieveencodedobjectwasycasycasycessreceiptencodeexcomspec=c:\windows\system32\cmd.exeqcertdllverifyrevocationnvm_symlink=c:\program" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "https://secure.logmein.com0&0$0" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "https://secure.logmein.com1x0vhttps://secure.logmein.com" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001428.00000000.184815.02DF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/channel" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crle3913.cd.akamaiedge.netocsp.digicert.comdelawareprivate" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "https://www.digicert.com/cps0.digicert.com0l@http:ps.digicert.com/digicertassuredidwingca-1.crt0g]" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001428.00000000.184815.02E9C000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0jc0a060)0'http://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001428.00000000.184815.033C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001428.00000000.184815.033C0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001428.00000000.184815.033C0000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00001428.00000000.184815.033C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "https://secure.logmein.com0/" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00001428.00000000.184815.041E0000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.04740000.00000004.mdmp") Found URL "https://status.gotoresolve.com/" - Source: "00000000-00004728.00000000.183216.04740000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.04740000.00000004.mdmp") Found URL "https://support.goto.com/de/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.04740000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolp" - Source: "00000000-00004728.00000000.183216.04740000.00000004.mdmp") Found URL "https://status.gotoresolve.com/" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/pt/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/pt/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/es/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/it/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/it/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/fr/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/fr/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/es/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.goto.com/de/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://status.gotoresolveerverstatus" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/3506702571605499921fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.compublickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1759417383677regionglobald&%s,,rt5px=0%%shso%%shuo%%s8vo%%spj%%shl%%s(m%%sp%%s" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com" - Source: "00000000-00004728.00000000.183216.066F0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://l" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://dumpster.console.gotoresolve.comsetupcrashhandlermissing" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://dumpster.dev01-console.gotoresolve.comminidumpformathostnameversionsessionidsuccessfully" - Source: "00000000-00004728.00000001.183812.00979000.00000002.mdmp") Found URL "https://support.goto.com/de/resolve/help/allowlistinto-resolve" - Source: "00000000-00004728.00000001.183812.066F6000.00000004.mdmp") Found URL "https://status.gotoresolvepdtplen" - Source: "00000000-00004728.00000001.183812.066F6000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004728.00000001.183812.06763000.00000004.mdmp") Found URL "https://support.goto.com/de/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000001.183812.06763000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004728.00000001.183812.06763000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/3506702571605499921fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.compublickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1759417383677" - Source: "00000000-00004728.00000001.183812.06763000.00000004.mdmp") Found URL "https://secure.logmein.com@1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00005716.00000000.184235.00840000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120250902090159zdigicert," - Source: "00000000-00005716.00000000.184235.00A50000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlecurity=impersonation" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crlc:\program" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl:\program" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.2.840.113549.1.1.52.16.840.1.113730.1.1g6" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f*9v)" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/psmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lekpt0entrust," - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "https://secure.logmein.comhttps://secure.logmein.comhttps://secure.logmein.com0o0m0k0i0" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lq]dlk2jnk2jnbz69xcpx" - Source: "00000000-00005716.00000000.184235.00A85000.00000004.mdmp") Found URL "https://secure.logmein.com0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005716.00000000.184235.05040000.00000004.mdmp") Found URL "https://secure.logmein.com0cwt" - Source: "00000000-00005716.00000000.184235.05040000.00000004.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timehttp://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.webrtc.org/experiments/rtp-hdrext/video-content-typehttp://www.webrtc.org/experiments/rtp-hdrext/video-timinghttp://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00https://aomediacodec.github.io/av1-rtp-spec/" - Source: "00000000-00005716.00000000.184235.7164E000.00000002.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02http://www.webrtc.org/experiments/rtp-hdrext/playout-delayhttp://www.webrtc.org/experiments/rtp-hdrext/color-spaceurn:ietf:params:rtp-hdrext:sdes:midurn:ietf:params:rtp-hdrext:sdes:rtp-stream-idurn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-idhttp://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-idurn:ietf:params:rtp-hdrext:csrc-audio-levelpbo@profile-level-idl" - Source: "00000000-00005716.00000000.184235.7164E000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005716.00000000.184235.7164E000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005716.00000001.185105.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005716.00000001.185105.00840000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005716.00000001.185105.00840000.00000004.mdmp") Found URL "https://secure.logmein.com01^2-j+g/je4pk" - Source: "00000000-00005716.00000001.185105.00840000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlecurity=impersonation" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl:\program" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.2.840.113549.1.1.52.16.840.1.113730.1.1g6" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f*9v)" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/psmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lekpt0entrust," - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.c%vpjparam" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lprogramfiles(x86)=c:\program" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://secure.logmein.combaseurlcompanyidcreatedatfalsehostidlangloglevelnamespaceofflineproductregionglobalsaltservicenamewebsiteurlworkfolderpublickeyyfaqg129tj0&0$0" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "http://ocsdela.rivate" - Source: "00000000-00005716.00000001.185105.00A85000.00000004.mdmp") Found URL "https://secure.logmein.com05a[hjsic6+>_" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/diustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005716.00000001.185105.00AF6000.00000004.mdmp") Found URL "https://l" - Source: "00000000-00005716.00000001.185105.00D69000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00005716.00000001.185105.00D69000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00005716.00000001.185105.00D69000.00000002.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "https://secure.logmein.com0s" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "https://secure.logmein.com01^2-j+g/je4pk" - Source: "00000000-00005716.00000001.185105.05040000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00005716.00000001.185105.059D1000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comc:\program" - Source: "00000000-00005716.00000001.185105.059D9000.00000004.mdmp") Found URL "https://devices-iot.console.g'" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00005716.00000001.185105.059F9000.00000004.mdmp") Found URL "http://www.openssl.org/support/faq.html@@l" - Source: "00000000-00005716.00000001.185105.71AFF000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00006496.00000000.185497.00255000.00000002.mdmp")6f:T50d,YARA signature to detect medium entropy file process "00000000-00005716" YARA signature to detect medium entropy file file "GoToResolveNetworkChecker.exe" YARA signature to detect medium entropy file process "00000000-00006496" YARA signature to detect medium entropy file process "00000000-00004728" YARA signature to detect medium entropy file file "LMISupportM64.exe" YARA signature to detect medium entropy file process "00000000-00001428" YARA signature to detect medium entropy file file "libcrypto-3.dll" YARA signature to detect medium entropy file file "g2rvdd.dll" YARA signature to detect medium entropy file file "GoToResolveRemoteControl.exe" YARA signature to detect medium entropy file file "GoToResolveProcessChecker.exe" YARA signature to detect medium entropy file process "00000000-00000836" YARA signature to detect medium entropy file file "GoToResolveExternalModuleHandler.exe" YARA signature to detect medium entropy file file "GoToResolveTools32.exe" YARA signature to detect medium entropy file file "GoToResolveServiceManager.exe" YARA signature to detect medium entropy file file "FileManager.dll" YARA signature to detect medium entropy file file "GoToResolveCrashHandler.exe" YARA signature to detect medium entropy file process "00000000-00001056"70:T621,YARA signature for RC4 encryption matched on process "00000000-00005716" YARA signature for RC4 encryption matched on file "GoToResolveNetworkChecker.exe" YARA signature for RC4 encryption matched on process "00000000-00006496" YARA signature for RC4 encryption matched on process "00000000-00004728" YARA signature for RC4 encryption matched on file "LMISupport7x64.dll" YARA signature for RC4 encryption matched on file "LMISupportM64.exe" YARA signature for RC4 encryption matched on file "LMISupport7x32.dll" YARA signature for RC4 encryption matched on file "libcrypto-3-x64.dll" YARA signature for RC4 encryption matched on file "libcrypto-3.dll" YARA signature for RC4 encryption matched on file "g2rvdd.dll" YARA signature for RC4 encryption matched on file "GoToResolveRemoteControl.exe" YARA signature for RC4 encryption matched on file "GoToResolveProcessChecker.exe" YARA signature for RC4 encryption matched on file "GoToResolveExternalModuleHandler.exe" YARA signature for RC4 encryption matched on file "libssl-3.dll" YARA signature for RC4 encryption matched on file "GoToResolveTools32.exe" YARA signature for RC4 encryption matched on process "00000000-00000836" YARA signature for RC4 encryption matched on file "lmiscrhook64.dll" YARA signature for RC4 encryption matched on file "GoToResolveServiceManager.exe" YARA signature for RC4 encryption matched on file "FileManager.dll" YARA signature for RC4 encryption matched on file "GoToResolveCrashHandler.exe" YARA signature for RC4 encryption matched on file "GoToResolveUi.exe"71:T686,YARA signature matched on R0R instruction used in file "GoToResolveNetworkChecker.exe" YARA signature matched on R0R instruction used in file "LMISupport7x64.dll" YARA signature matched on R0R instruction used in file "LMISupportM64.exe" YARA signature matched on R0R instruction used in file "LMISupport7x32.dll" YARA signature matched on R0R instruction used in file "libcrypto-3-x64.dll" YARA signature matched on R0R instruction used in file "libcrypto-3.dll" YARA signature matched on R0R instruction used in file "g2rvdd.dll" YARA signature matched on R0R instruction used in file "GoToResolveRemoteControl.exe" YARA signature matched on R0R instruction used in file "GoToResolveProcessChecker.exe" YARA signature matched on R0R instruction used in file "GoToResolveExternalModuleHandler.exe" YARA signature matched on R0R instruction used in file "libssl-3.dll" YARA signature matched on R0R instruction used in file "GoToResolveTools32.exe" YARA signature matched on R0R instruction used in file "lmiscrhook64.dll" YARA signature matched on R0R instruction used in file "GoToResolveServiceManager.exe" YARA signature matched on R0R instruction used in file "FileManager.dll" YARA signature matched on R0R instruction used in file "GoToResolveCrashHandler.exe" YARA signature matched on R0R instruction used in file "GoToResolveUi.exe" YARA signature matched on R0R instruction used in file "lmiscrhook32.dll" YARA signature matched on R0R instruction used in file "GoToResolveUnattendedUi.exe" YARA signature matched on R0R instruction used in file "GoToResolveUnlock64.dll" YARA signature matched on R0R instruction used in file "legacy.dll"72:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")73:T144f,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")74:T646,Found reference to API "26834587047,2180,3025,,RtlGetNtProductType,NTDLL.dll,"00:47:53.390",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27451769781,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.640",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "26843816581,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.390",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27161326100,2180,3025,,RtlGetNtProductType,NTDLL.dll,"00:47:53.515",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27211243670,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.546",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27453118863,2180,3024,,RtlGetVersion,NTDLL.dll,"00:47:53.640",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "26757945705,2180,3025,,RtlGetNtProductType,NTDLL.dll,"00:47:53.359",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp") Found reference to API "27453062625,2180,3025,,RtlGetNtProductType,NTDLL.dll,"00:47:53.640",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp")75:Tc72,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: libcrypto-3.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: libssl-3-x64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveTools64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PasswordPrivacyDll.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: libssl-3.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveTools32.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveUnlock64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveCrashHandler.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: legacy.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveUnlock32.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: LMISupport7x64.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveProcessChecker.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveLoggerProcess.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveRemoteControl.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveUnattendedUi.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveUnattended.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveUnattendedRemover.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveExternalModuleHandler.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveRegistryEditor.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveNetworkChecker.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GoToResolveServiceManager.exe]76:T16dc,Found string "C:\pumpkin_cache\boost-1.83.0-18\include\boost/archive/iterators/base64_from_binary.hpp" (Indicator: "base64"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.6EE35000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.0302B000.00000004.mdmp") Found string "AES-128 counter mode using openssl" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "AES-192 counter mode using openssl" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "AES-256 counter mode using openssl" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "AES-128 GCM using openssl" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "AES-256 GCM using openssl" (Indicator: "aes"; Source: "00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "CAST5-CBC" (Indicator: "cast5"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "aes-256-ccm" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-CCM" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-CCM" (Indicator: "aes256"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "aes-256-gcm" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-GCM" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-GCM" (Indicator: "aes256"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "AES-128-ECB" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "AES-128-OFB" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "AES-192-CFB" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.0307C000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes128-wrap-pad" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes128-wrap-pad" (Indicator: "aes128"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-wrap-pad" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes256-wrap-pad" (Indicator: "aes256"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-wrap-pad" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-wrap-pad" (Indicator: "aes192"; Source: "00000000-00000836.00000001.185126.05C91000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes128-CCM" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes128-CCM" (Indicator: "aes128"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "aes-128-ccm" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-CCM" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-CCM" (Indicator: "aes192"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-GCM" (Indicator: "aes"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found string "id-aes192-GCM" (Indicator: "aes192"; Source: "00000000-00000836.00000001.185126.05C9F000.00000004.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp")77:T70b,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")78:T1411,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "class common::util::ProcessList &__thiscall boost::system::result::operator *(void) noexcept &" (Indicator: "ProcessList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "const class boost::system::error_code &__thiscall boost::variant2::detail::variant_base_impl<0,0,class common::util::ProcessList,class boost::system::error_code>::_get_impl<0x1>(struct std::integral_constant) noexcept const" (Indicator: "ProcessList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "C:\a\rescue-native-rescueassist\rescue-native-rescueassist\lib\common\common\util\win\ProcessList.cpp" (Indicator: "ProcessList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")79:T442,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")7a:Tcfb,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "unsigned __int64 __cdecl crashpad::GetFileSize(const class base::FilePath &)" (Indicator: "GetFileSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileSize() error: {}" (Indicator: "GetFileSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp")7b:T4eb,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleFileName() error: {}" (Indicator: "GetModuleFileName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")7c:T8e8,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp") Found reference to API "27247736097,2180,3194,,GetUserNameExW,secur32.dll,"00:47:53.562",RX=0,PX=0" (Indicator: "GetUserName"; Source: "00000000-00000836.00000001.185126.05D14000.00000004.mdmp")7d:T1345,Found string ":\program files (x86)\goto resolve unattended\3506702571605499921\passwordprivacydll.dll" (Indicator: "password"; Source: "00000000-00000836.00000000.183492.02F80000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00000836.00000000.183492.05C8C000.00000004.mdmp, 00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00000836.00000000.183492.05C8C000.00000004.mdmp, 00000000-00000836.00000000.183492.05E80000.00000002.mdmp") Found string "health-elevation-username-or-password-incorrect" (Indicator: "password"; Source: "00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.03063000.00000004.mdmp, 00000000-00000836.00000001.185126.03071000.00000004.mdmp, 00000000-00000836.00000001.185126.05C9F000.00000004.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00000836.00000001.185126.06020000.00000002.mdmp")7e:T409,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "bool __cdecl crashpad::`anonymous-namespace'::LoggingRemoveDirectoryImpl(const class base::FilePath &)" (Indicator: "RemoveDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "bool __cdecl crashpad::LoggingRemoveDirectory(const class base::FilePath &)" (Indicator: "RemoveDirectory"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe")7f:T46e,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe")80:T897,Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "IsTokenRestricted" (Indicator: "IsTokenRestricted"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "Check failed: RevertToSelf()" (Indicator: "RevertToSelf"; File: "00000000-00006496.00000000.185497.001E1000.00000020.mdmp")81:T4ea,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F4E6000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp")82:Tfce,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: PasswordPrivacyDll.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: PasswordPrivacyDll.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: PasswordPrivacyDll.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: PasswordPrivacyDll.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PasswordPrivacyDll.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: PasswordPrivacyDll.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: PasswordPrivacyDll.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: PasswordPrivacyDll.dll] Observed import api "IsTokenRestricted" which can "indicate whether a token contains a list of restricted security identifiers (SIDs)" [Source: PasswordPrivacyDll.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: PasswordPrivacyDll.dll] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: PasswordPrivacyDll.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: GoToResolveUnlock64.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: GoToResolveUnlock64.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GoToResolveUnlock64.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: GoToResolveUnlock64.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: GoToResolveUnlock64.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: GoToResolveUnlock32.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: GoToResolveUnlock32.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GoToResolveUnlock32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: GoToResolveUnlock32.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: GoToResolveUnlock32.dll]83:Tcca,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")84:T522,Dropped file: "UnattendedUpdater.csv" - Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv]- [targetUID: 00000000-00004728] Dropped file: "UnattendedUpdater.log" - Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log]- [targetUID: 00000000-00004728] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] Dropped file: "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00005716] Dropped file: "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00005716]85:Tec1,Found string "InitializeProcThreadAttributeList" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "UpdateProcThreadAttribute" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "CreateHardLinkW" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "NtCreateFile" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: NTDLL.DLL) Found string "NtQueryDirectoryFile" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: NTDLL.DLL) Found string "GetCurrentPackageId" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "SleepConditionVariableCS" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL) Found string "EnumSystemLocalesEx" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "system" (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe, API is part of module: MSVCRT.DLL)86:T5aa,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" was detected as "VC8 -> Microsoft Corporation" "libcrypto-3.dll" was detected as "Microsoft visual C++ 8.0" "libssl-3-x64.dll" was detected as "Microsoft visual C++ 8.0" "PasswordPrivacyDll.dll" was detected as "Borland Delphi 3.0 (???)" "libssl-3.dll" was detected as "Microsoft visual C++ 8.0" "GoToResolveTools32.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveCrashHandler.exe" was detected as "VC8 -> Microsoft Corporation" "legacy.dll" was detected as "Microsoft visual C++ 8.0" "GoToResolveUnlock32.dll" was detected as "Borland Delphi 3.0 (???)" "GoToResolveProcessChecker.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveLoggerProcess.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveRemoteControl.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveUnattendedUi.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveUnattended.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveUnattendedRemover.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveExternalModuleHandler.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveRegistryEditor.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveNetworkChecker.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveServiceManager.exe" was detected as "VC8 -> Microsoft Corporation"87:T8ac,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has section name .text with entropy "6.583694346482471" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has section name .rsrc with entropy "7.999988352173047" "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" has section name .reloc with entropy "6.62757793079858" "libcrypto-3.dll" has section name .reloc with entropy "6.269731015191771" "GoToResolveTools64.exe" has section name .text with entropy "6.435122206240347" "GoToResolveTools64.exe" has section name .pdata with entropy "6.028377418702032" "PasswordPrivacyDll.dll" has section name .text with entropy "6.684996967912218" "PasswordPrivacyDll.dll" has section name .reloc with entropy "6.622267276344464" "libssl-3.dll" has section name .reloc with entropy "6.22946439973097" "GoToResolveTools32.exe" has section name .text with entropy "6.598211028007038" "GoToResolveTools32.exe" has section name .reloc with entropy "6.611429121581948" "GoToResolveUnlock64.dll" has section name .text with entropy "6.476461614991889" "GoToResolveCrashHandler.exe" has section name .text with entropy "6.573441207677247" "GoToResolveCrashHandler.exe" has section name .reloc with entropy "6.566473473767943" "legacy.dll" has section name .reloc with entropy "6.118751447769325" "GoToResolveUnlock32.dll" has section name .text with entropy "6.6530953562574195" "GoToResolveUnlock32.dll" has section name .reloc with entropy "6.567054172177482" "LMISupport7x64.dll" has section name .text with entropy "6.403594943627713" "GoToResolveProcessChecker.exe" has section name .text with entropy "6.631153913128338" "GoToResolveProcessChecker.exe" has section name .rsrc with entropy "6.898055444318538" "GoToResolveProcessChecker.exe" has section name .reloc with entropy "6.551195448746002" "GoToResolveLoggerProcess.exe" has section name .text with entropy "6.631153913128338" "GoToResolveLoggerProcess.exe" has section name .rsrc with entropy "6.89963060569376" "GoToResolveLoggerProcess.exe" has section name .reloc with entropy "6.551195448746002" "GoToResolveRemoteControl.exe" has section name .text with entropy "6.631153913128338"88:T24af,"LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll]- [targetUID: 00000000-00005716] "libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3-x64.dll]- [targetUID: 00000000-00004728] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll]- [targetUID: 00000000-00005716] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll]- [targetUID: 00000000-00005716] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll]- [targetUID: 00000000-00005716] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3-x64.dll]- [targetUID: 00000000-00004728] "GoToResolveTools64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools64.exe]- [targetUID: 00000000-00004728] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll]- [targetUID: 00000000-00005716] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll]- [targetUID: 00000000-00005716] "GoToResolveTools32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools32.exe]- [targetUID: 00000000-00004728] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004728] "GoToResolveCrashHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveCrashHandler.exe]- [targetUID: 00000000-00004728] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\legacy.dll]- [targetUID: 00000000-00004728] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004728] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x64.dll]- [targetUID: 00000000-00004728] "GoToResolveProcessChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveProcessChecker.exe]- [targetUID: 00000000-00005716] "GoToResolveLoggerProcess.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveLoggerProcess.exe]- [targetUID: 00000000-00004728] "GoToResolveRemoteControl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRemoteControl.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattendedUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedUi.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattended.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe]- [targetUID: 00000000-00004728] "GoToResolveUnattendedRemover.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedRemover.exe]- [targetUID: 00000000-00004728] "GoToResolveExternalModuleHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveExternalModuleHandler.exe]- [targetUID: 00000000-00004728] "GoToResolveRegistryEditor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRegistryEditor.exe]- [targetUID: 00000000-00004728] "GoToResolveNetworkChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveNetworkChecker.exe]- [targetUID: 00000000-00004728] "GoToResolveServiceManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveServiceManager.exe]- [targetUID: 00000000-00004728] "GoToResolveFileManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveFileManager.exe]- [targetUID: 00000000-00004728] "GoToResolveQuickView.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveQuickView.exe]- [targetUID: 00000000-00004728] "GoToResolveTerminal.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTerminal.exe]- [targetUID: 00000000-00004728] "GoToResolveUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUi.exe]- [targetUID: 00000000-00004728] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x32.dll]- [targetUID: 00000000-00004728] "LMISupportM64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM64.exe]- [targetUID: 00000000-00004728] "LMISupportM32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM32.exe]- [targetUID: 00000000-00004728] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook64.dll]- [targetUID: 00000000-00004728] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook32.dll]- [targetUID: 00000000-00004728] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook64.dll]- [targetUID: 00000000-00004728] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook64.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.dll]- [targetUID: 00000000-00004728] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook32.dll]- [targetUID: 00000000-00004728] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook32.dll]- [targetUID: 00000000-00004728] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.dll]- [targetUID: 00000000-00004728] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: 00000000-00004728]89:T4bc9,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveProcessChecker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 25712 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveLoggerProcess.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRemoteControl.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattended.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedUi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnattendedRemover.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26120 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LibGoToResolve.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26184 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveNetworkChecker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26160 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveQuickView.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26168 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveFileManager.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26152 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTerminal.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26176 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveServiceManager.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26216 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveExternalModuleHandler.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 26184 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveRegistryEditor.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 54072 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x86\g2rvdd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 13648 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\x64\g2rvdd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 2632 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 17480 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIFilterHook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 584 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 13896 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMIInputHook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 31304 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 9800 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\lmiscrhook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 10824 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 58952 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMISupport7x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 44104 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 25160 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\LMISupportM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 16448 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\MediaClientLib.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010800 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 57024 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\PasswordPrivacyDll.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 46120 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\FileManager.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000480100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 5816 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000400100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 50872 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveTools64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 12960 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveCrashHandler.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 20576 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 60000 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\GoToResolveUnlock64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 14344 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\legacy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 29704 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 10760 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\libcrypto-3-x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 42504 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" wrote 31752 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\3506702571605499921\libssl-3-x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...8a:T6a6,"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" claimed CRC 24479288 while the actual is CRC 24449663 "libssl-3-x64.dll" claimed CRC 1533804 while the actual is CRC 4469645 "GoToResolveTools64.exe" claimed CRC 1374909 while the actual is CRC 1533804 "PasswordPrivacyDll.dll" claimed CRC 1218003 while the actual is CRC 1374909 "libssl-3.dll" claimed CRC 1175580 while the actual is CRC 1218003 "GoToResolveTools32.exe" claimed CRC 1158567 while the actual is CRC 1175580 "GoToResolveUnlock64.dll" claimed CRC 771911 while the actual is CRC 1158567 "GoToResolveCrashHandler.exe" claimed CRC 713990 while the actual is CRC 771911 "legacy.dll" claimed CRC 648018 while the actual is CRC 713990 "GoToResolveUnlock32.dll" claimed CRC 578130 while the actual is CRC 648018 "LMISupport7x64.dll" claimed CRC 494983 while the actual is CRC 578130 "GoToResolveProcessChecker.exe" claimed CRC 444665 while the actual is CRC 494983 "GoToResolveLoggerProcess.exe" claimed CRC 428630 while the actual is CRC 444665 "GoToResolveRemoteControl.exe" claimed CRC 461027 while the actual is CRC 428630 "GoToResolveUnattendedUi.exe" claimed CRC 437333 while the actual is CRC 461027 "GoToResolveUnattended.exe" claimed CRC 465618 while the actual is CRC 437333 "GoToResolveUnattendedRemover.exe" claimed CRC 431446 while the actual is CRC 465618 "GoToResolveExternalModuleHandler.exe" claimed CRC 429054 while the actual is CRC 431446 "GoToResolveRegistryEditor.exe" claimed CRC 442939 while the actual is CRC 429054 "GoToResolveNetworkChecker.exe" claimed CRC 479562 while the actual is CRC 442939 "GoToResolveServiceManager.exe" claimed CRC 463407 while the actual is CRC 4795628b:T673,ChangeServiceConfig2W StartServiceW RegOpenKeyExA RegCreateKeyExW RegCreateKeyExA RegDeleteKeyW RegDeleteKeyExA RegCloseKey CertDeleteCertificateFromStore LoadLibraryA GetFileAttributesW CreateFileW DeleteFileW FindNextFileW GetDriveTypeW GetCommandLineA GetModuleHandleExW CreateDirectoryW LoadLibraryW OutputDebugStringW MapViewOfFile GetVersionExW GetFileSizeEx CopyFileExW GetStartupInfoW GetCommandLineW SleepEx CreateFileMappingW GetProcAddress GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter GetFileAttributesExW LockResource FindResourceW TerminateProcess CreateProcessW CreateThread ExitThread LoadLibraryExW Sleep CreateDirectoryExW GetFileSize DeviceIoControl GetModuleHandleW OpenProcess WriteFile SleepConditionVariableSRW FindFirstFileExW ShellExecuteExW ShellExecuteW GetWindowThreadProcessId FindWindowW WSAStartup GetTempPathW GetSystemInfo VirtualAlloc FindFirstFileW GetSystemDirectoryA VirtualProtect connect recvfrom sendto recv closesocket send socket listen accept bind RegOpenKeyExW VirtualAllocEx GetNativeSystemInfo GetSystemDirectoryW WriteProcessMemory CreateRemoteThread ReadProcessMemory GetComputerNameW GetFileAttributesA RegEnumKeyExW RegDeleteValueW OpenProcessToken CreateProcessAsUserW SetSecurityDescriptorDacl GetModuleFileNameA GetTickCount CreateToolhelp32Snapshot GetModuleHandleA Process32FirstW Process32NextW EnumProcesses GetModuleFileNameExW OpenFileMappingW GetThreadContext LoadLibraryExA ConnectNamedPipe DisconnectNamedPipe VirtualProtectEx FindNextFileA FindFirstFileExA FindResourceExW8c:T834,Spawned process "6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe" (UID: 00000000-00004728) Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00000836) Spawned process "cmd.exe" with commandline "/S /C ""C:\\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe.cmd" "C:\\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe""" (UID: 00000000-00003180) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006128) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006196) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00007452) Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 836 -InstallationId YfAqG129TJ -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506702571605499921" -ApplicationType 4 -Environment "Production" -ForceInstall 0" (UID: 00000000-00005716) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506702571605499921" -ApplicationType "4"" (UID: 00000000-00001428) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506702571605499921\\appdata\\ProcessCheckerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\3506702571605499921\\appdata\\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-FVVF82A --annotation=installationid=YfAqG129TJ --annotation=version=1.27.1.2836 --initial-client-data=0x80c,0x810,0x814,0x7d4,0x81c,0x6ef86fac,0x6ef86fbc,0x6ef86fcc" (UID: 00000000-00006496) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "1428" "-InstallationId" "YfAqG129TJ" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_3506702571605499921" "-Service" "-LogLevel" "2"" (UID: 00000000-00001056)8d:T895,"GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "PHANTOM") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "PHANTOM") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "HARDWAREID")8e:T8c2,"GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "PHANTOM") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2257ECD7&0&000000"; Key: "HARDWAREID")8f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEVVXd3d3d3d1VVVAAAAAAVd3d3d2IiN3d3d1VAAAABV3d3diP///4jd3d1VAAAAXd3dj///////+N3d1QAAAF3d2P////////+N3dUAAABd3Y//////////+N3dAAAA3dj///////////+N3QAAAN3f/33Y////jdf//d0AAADdj/jd3YiIiN3dj/jdAAAA3Y/93d3d3d3d3d/43QAAAN3/+N3diIiI3d2P/90AAADY//+N2P///43Y//+NAAAA2P///42P//jY////jQAAANj////4f//3j////40AAADY////+Nj/jY////+NAAAA3f////+N/9j/////3QAAAN3//////Xff/////90AAAB3j////4fXeP////h3AAAA13////+Hd3j////3dwAAAHd4////h3d4////h30AAAB3d4////h3j///+Hd3AAAAd3d4/////////4d3dwAAAHd3d4////////h3d3cAAAB4iIiIj/////iIiIiHAAAACIiIiIiIiIiIiIiIgAAAAACIiIiIiIiIiIiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////8AAA/+AAAH/AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH8AAAD/AAAA/4AAAf/gAAf////////////////w==90:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEVVXd3d3d3d1VVVAAAAAAVd3d3d2IiN3d3d1VAAAABV3d3diP///4jd3d1VAAAAXd3dj///////+N3d1QAAAF3d2P////////+N3dUAAABd3Y//////////+N3dAAAA3dj///////////+N3QAAAN3f/33Y////jdf//d0AAADdj/jd3YiIiN3dj/jdAAAA3Y/93d3d3d3d3d/43QAAAN3/+N3diIiI3d2P/90AAADY//+N2P///43Y//+NAAAA2P///42P//jY////jQAAANj////4f//3j////40AAADY////+Nj/jY////+NAAAA3f////+N/9j/////3QAAAN3//////Xff/////90AAAB3j////4fXeP////h3AAAA13////+Hd3j////3dwAAAHd4////h3d4////h30AAAB3d4////h3j///+Hd3AAAAd3d4/////////4d3dwAAAHd3d4////////h3d3cAAAB4iIiIj/////iIiIiHAAAACIiIiIiIiIiIiIiIgAAAAACIiIiIiIiIiIiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////8AAA/+AAAH/AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH8AAAD/AAAA/4AAAf/gAAf////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791436489646,"unified_at":"2026-10-08T05:14:49.646Z","metadata":{"hashes":{"sha256":"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8","sha1":"3a82bc2d3981417f70f7d649405e4e36d3255c6f","md5":"4417d007fb349e22cc38afcd1f96539f","sha512":"2baafc91ea58ff570367f4e084f3d69524fb668fb1925d35dca6af7ad7e183596fdd047155cb11e19bd9d0541ccd153134a1b8daec397e314709259179e2f4f8","ssdeep":"393216:q2mcrgZIm4fQoPl9CDyoC0CiLHOBp3IigWt3TWh5kCeSGhR5yZ8+4k:zgKsGCDy6rOvYigsjQ5khhho8","ssdeep_chunks":["393216:q2mcrgZ","393216:2mcrgZI","393216:mcrgZIm","393216:crgZIm4","393216:rgZIm4f","393216:gZIm4fQ","393216:ZIm4fQo","393216:Im4fQoP","393216:m4fQoPl","393216:4fQoPl9","393216:fQoPl9C","393216:QoPl9CD","393216:oPl9CDy","393216:Pl9CDyo","393216:l9CDyoC","393216:9CDyoC0","393216:CDyoC0C","393216:DyoC0Ci","393216:yoC0CiL","393216:oC0CiLH","393216:C0CiLHO","393216:0CiLHOB","393216:CiLHOBp","393216:iLHOBp3","393216:LHOBp3I","393216:HOBp3Ii","393216:OBp3Iig","393216:Bp3IigW","393216:p3IigWt","393216:3IigWt3","393216:IigWt3T","393216:igWt3TW","393216:gWt3TWh","393216:Wt3TWh5","393216:t3TWh5k","393216:3TWh5kC","393216:TWh5kCe","393216:Wh5kCeS","393216:h5kCeSG","393216:5kCeSGh","393216:kCeSGhR","393216:CeSGhR5","393216:eSGhR5y","393216:SGhR5yZ","393216:GhR5yZ8","393216:hR5yZ8+","393216:R5yZ8+4","393216:5yZ8+4k","786432:q2mcrgZ","786432:2mcrgZI","786432:mcrgZIm","786432:crgZIm4","786432:rgZIm4f","786432:gZIm4fQ","786432:ZIm4fQo","786432:Im4fQoP","786432:m4fQoPl","786432:4fQoPl9","786432:fQoPl9C","786432:QoPl9CD","786432:oPl9CDy","786432:Pl9CDyo","786432:l9CDyoC","786432:9CDyoC0","786432:CDyoC0C","786432:DyoC0Ci","786432:yoC0CiL","786432:oC0CiLH","786432:C0CiLHO","786432:0CiLHOB","786432:CiLHOBp","786432:iLHOBp3","786432:LHOBp3I","786432:HOBp3Ii","786432:OBp3Iig","786432:Bp3IigW","786432:p3IigWt","786432:3IigWt3","786432:IigWt3T","786432:igWt3TW","786432:gWt3TWh","786432:Wt3TWh5","786432:t3TWh5k","786432:3TWh5kC","786432:TWh5kCe","786432:Wh5kCeS","786432:h5kCeSG","786432:5kCeSGh","786432:kCeSGhR","786432:CeSGhR5","786432:eSGhR5y","786432:SGhR5yZ","786432:GhR5yZ8","786432:hR5yZ8+","786432:R5yZ8+4","786432:5yZ8+4k","393216:zgKsGCD","393216:gKsGCDy","393216:KsGCDy6","393216:sGCDy6r","393216:GCDy6rO","393216:CDy6rOv","393216:Dy6rOvY","393216:y6rOvYi","393216:6rOvYig","393216:rOvYigs","393216:OvYigsj","393216:vYigsjQ","393216:YigsjQ5","393216:igsjQ5k","393216:gsjQ5kh","393216:sjQ5khh","393216:jQ5khhh","393216:Q5khhho","393216:5khhho8"],"imphash":"f8e4a22bcb1b836585534b93f63c1414"},"file_info":{"file_name":"ZoomWorkspace.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":24443880,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1762518945000,"last_seen":1762723335000,"last_multi_scan":1762723335000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":106},"sandbox_signatures":{"informative_count":293,"suspicious_count":18,"malicious_count":10,"total":321},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win.LogMeIn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_RemoteAdmin_LogMeIn_A_potentially_unsafe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/RemoteAdmin.LogMeIn.A potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"PUP.Win32.RemoteAdmin.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"RemoteTool ( 005d14181 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.LogMeIn.lbqnlh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Riskware.LogMeIn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.LogMeIn.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.LogMeIn","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - Cyclic XOR decryption routine for 64-bit samples"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Safe Mode Boot","attack_id":"T1562.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/009","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"},{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"malicious","value":"Reads VM specific registry key"},{"type":"malicious","value":"Reads the registry for VMWare specific artifacts"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks process/system information retrieval APIs"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"The WS-Management service does not support the specified compression scheme (%1).\" (Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")\n Found string \"The only supported compression type is \"xpress\".\" (Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")\n Found string \"The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value.\" (Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")\n Found string \"Change the value for the compression option and try the request again.\" (Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"FindResourceW\" with parameter \"32000\" - (UID: 00000000-00004728)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '10248552'}\" (UID: 00000000-00004728)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 726C0000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 726C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000836-55879-44-003467BB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000836-55879-46-003289A4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000836-55879-957-00328E41\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000836-55879-962-00328CAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-61-00227C9C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-63-002231DA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-2056-001E6580\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-2073-001E7450\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-2074-0021E6B0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-2238-00223D55\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006496-61847-2869-00223EDB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"No public key found, can not store it.\" (Indicator: \"public key\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000836.00000000.183492.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.02F80000.00000004.mdmp\")\n Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")\n Found string \"The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable.\" (Indicator: \"private key\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \". > N ^ n ~\" (Indicator: \" ^ \"; Source: \"00000000-00000836.00000000.183492.05C8C000.00000004.mdmp, 00000000-00000836.00000000.183492.05E80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe]\n Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: GoToResolveTools64.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: GoToResolveTools64.exe]\n Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: GoToResolveTools32.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: GoToResolveTools32.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GoTo Resolve Unattended\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n file/memory contains long string with (Indicator: \"WTSEnumerateProcesses\"; File: \"LMISupportM32.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00000836-00000C2B-1872524828\")\n Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00000836-00000C2B-1872524854\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00000836-00000C2B-1872524926\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000836-00000C2B-1872409227\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfig2W\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"QueryServiceStatus\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"EnumServicesStatusW\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"QueryServiceConfigW\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"QueryServiceConfig failed, could not get the required size of buffer for service config. Error: %d\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found string \"QueryServiceConfig failed. Error: %d\" (File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"LMISupportM32.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"LMISupportM32.exe\")\n file/memory contains long string with (Indicator: \"postmessage\"; File: \"lmiscrhook64.dll\")\n file/memory contains long string with (Indicator: \"postmessage\"; File: \"lmiscrhook32.dll\")\n Found reference to API \"WTSSendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000836-00000C2B-1872524896\")\n Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000836-00000C2B-1877540411\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"GoToResolveUnattended.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000836)\n \"GoToResolveProcessChecker.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005716)\n \"GoToResolveProcessChecker.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001428)\n \"GoToResolveUnattended.exe\" called \"GetTickCount\" (UID: 00000000-00001056)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004728)\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"EnumServicesStatusW\" with parameters (UID: 00000000-00004728)\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004728)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004728)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"GoToResolveUnattended.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000836)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"IsWow64Process\" with parameter \"4728\" - (UID: 00000000-00004728)\n \"GoToResolveUnattended.exe\" called \"IsWow64Process\" with parameter \"836\" - (UID: 00000000-00000836)\n \"GoToResolveProcessChecker.exe\" called \"IsWow64Process\" with parameter \"5716\" - (UID: 00000000-00005716)\n \"GoToResolveProcessChecker.exe\" called \"IsWow64Process\" with parameter \"1428\" - (UID: 00000000-00001428)\n \"GoToResolveUnattended.exe\" called \"IsWow64Process\" (UID: 00000000-00001056)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"GetWindowTextW\" (UID: 00000000-00004728)\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00004728)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004728)\n \"GoToResolveUnattended.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000836)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"GoToResolveUnattended.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000836)\n \"GoToResolveProcessChecker.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001428)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: PasswordPrivacyDll.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"::IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00000836-55879-977-00352B8C\n FindFirstFileExW@KERNEL32.DLL at 00000000-00006496-61847-659-002480B0\n FindFirstFileExW@KERNEL32.DLL at 00000000-00006496-61847-1635-00247810\n FindFirstFileExW@KERNEL32.DLL at 00000000-00006496-61847-2343-0023EB86","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00006496-61847-1710-00252840\n GetDriveTypeW@KERNEL32.DLL at 00000000-00006496-61847-1724-00254503","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000836-55879-1250-00328BA1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-603-0024B730\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-761-0022D338\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00006496-61847-1729-00252491\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-2253-00223C4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000836-55879-1250-00328BA1\n GetLocalTime@KERNEL32.DLL at 00000000-00006496-61847-556-001EB0A0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-603-0024B730\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-761-0022D338\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006496-61847-2253-00223C4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00000836-55879-1421-0035A899\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00006496-61847-1021-00211470\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00006496-61847-2431-0023E4E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006496-61847-162-0024C830\n GetVersion@KERNEL32.DLL at 00000000-00006496-61847-2065-001F2450","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$37","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00006496-61847-1037-00210610\n GetSystemInfo@KERNEL32.DLL at 00000000-00006496-61847-1038-00210590\n GetSystemInfo@KERNEL32.DLL at 00000000-00006496-61847-1265-0024A750\n GetSystemInfo@KERNEL32.DLL at 00000000-00006496-61847-2483-0025181B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"EnumDesktopsW\" (Indicator: \"EnumDesktops\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"27361485418,2180,105,,GetForegroundWindow,user32.dll,\"00:47:53.609\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000836.00000001.185126.05D14000.00000004.mdmp\")\n Found reference to API \"27455798265,2180,105,,GetForegroundWindow,user32.dll,\"00:47:53.640\",RX=0,PX=0\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000836.00000001.185126.05D14000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$38","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00000836-55879-346-00356E70\n GetProcessHeap@KERNEL32.DLL at 00000000-00006496-61847-696-002429A0\n OpenProcess@KERNEL32.DLL at 00000000-00006496-61847-768-0021E8C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0035A9C3h\" at 00000000-00000836-55879-1421-0035A899\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 06h\" and \"jc 0024C8C3h\" at 00000000-00006496-61847-162-0024C830\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 06h\" and \"jc 001F2488h\" at 00000000-00006496-61847-2065-001F2450\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0023E613h\" at 00000000-00006496-61847-2431-0023E4E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\LIBGOTORESOLVE.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\LIBSSL-3.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\MEDIACLIENTLIB.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\FILEMANAGER.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\LIBCRYPTO-3.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\3506702571605499921\\PASSWORDPRIVACYDLL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"GoToResolveProcessChecker.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"GoToResolveProcessChecker.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GoToResolveUnattended.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"GoToResolveUnattended.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOTO RESOLVE UNATTENDED 3506702571605499921\")\n \"GoToResolveUnattended.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GOTORESOLVEPROCESSCHECKER.EXE\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOTO RESOLVE UNATTENDED 3506702571605499921\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed RMM Domain (gotoresolve .com in TLS SNI)\" (SID: 2061992, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"LMISupportM32.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"GoToResolveProcessChecker.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_1428_FQXNOHNIIOQTEFLJ\" - (UID: 00000000-00001428)\n \"GoToResolveProcessChecker.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ProcessChecker_YfAqG129TJ\" - (UID: 00000000-00001428)\n \"GoToResolveCrashHandler.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_1428_FQXNOHNIIOQTEFLJ\" - (UID: 00000000-00006496)\n \"GoToResolveUnattended.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\qt-420-79558603\" - (UID: 00000000-00001056)\n \"GoToResolveUnattended.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\qt-420-C0680D96\" - (UID: 00000000-00001056)\n \"GoToResolveUnattended.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\qt-420-7D63E9DC\" - (UID: 00000000-00001056)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"devices.console.gotoresolve.com\"\n \"devices-iot.console.gotoresolve.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.71.95.15:443\"\n \"3.209.57.87:443\"\n \"3.212.25.51:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\a\\rescue-native-rescueassist\\rescue-native-rescueassist\\build\\RelWithDebInfo\\GoToResolveUnattendedUpdater.pdb\"\n \"C:\\a\\rescue-native-rescueassist\\rescue-native-rescueassist\\build\\RelWithDebInfo\\GoToResolveUnattended.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"27454361021,2180,3142,,CreateProcessW,kernel32.dll,\"00:47:53.640\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000836.00000001.185126.05D14000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CreateDirectoryExW\" (Indicator: \"CreateDirectory\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"bool __cdecl crashpad::`anonymous-namespace'::CreateDirectoryIfNecessary(const class base::FilePath &)\" (Indicator: \"CreateDirectory\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"bool __cdecl crashpad::LoggingCreateDirectory(const class base::FilePath &,enum crashpad::FilePermissions,bool)\" (Indicator: \"CreateDirectory\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00006496-61847-2065-001F2450","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00006496-61847-166-0022318C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006496-61847-1884-001F2CB0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006496-61847-1891-001F2950\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006496-61847-1924-001F0530\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006496-61847-2115-001F0620\n SleepEx@KERNEL32.DLL at 00000000-00006496-61847-2809-0021FFF5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: GoToResolveTools64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PasswordPrivacyDll.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: GoToResolveTools32.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1169-00322EF0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1174-003233A0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1175-00325DD0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1183-00325160\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1185-00325BA0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000836-55879-1355-00344292\n LoadLibraryW@KERNEL32.DLL at 00000000-00006496-61847-164-001F2410\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006496-61847-2301-00227922\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006496-61847-2378-00238C52\n LoadLibraryExA@KERNEL32.DLL at 00000000-00006496-61847-2493-002519D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"ShellExecute failed: {}\" (Indicator: \"ShellExecute\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000836.00000001.185126.05D14000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"bool __thiscall crashpad::PEImageResourceReader::FindResourceByID(unsigned short,unsigned short,unsigned short,unsigned __int64 *,unsigned __int64 *,unsigned int *) const\" (Indicator: \"FindResource\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"OpenProcess failed with error:\" (Indicator: \"OpenProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$48","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe)\n Found MoveFileExW in import section (Source: GoToResolveTools64.exe)\n Found MoveFileExW in import section (Source: GoToResolveTools32.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$4a","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4b","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$4c","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\crashpad_%lu_\n Found string - \\\\.\\pipe\\crashpad_1428_FQXNOHNIIOQTEFLJ\n Found string - \\\\.\\pipe\\ProcessChecker_YfAqG129TJ\n Found string - \\\\.\\pipe\\qt-420-79558603\n Found string - \\\\.\\pipe\\qt-420-C0680D96\n Found string - \\\\.\\pipe\\qt-420-7D63E9DC\n Found string - \\\\.\\pipe\\GoToResolve_3506702571605499921","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$4e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 735E0000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 735E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 735E0000\n \"GoToResolveCrashHandler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76110000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000\n \"GoToResolveCrashHandler.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76390000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$50","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"leavebehind-update-new-application-extracted\"; Source: \"00000000-00000836.00000001.185126.02F80000.00000004.mdmp, 00000000-00000836.00000001.185126.03071000.00000004.mdmp, 00000000-00000836.00000001.185126.05C9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$51","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$52","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$53","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3-x64.dll\" : \"491\" [Source: libssl-3-x64.dll]\n Observed large number of imported APIs from \"libcrypto-3.dll\" : \"491\" [Source: libssl-3.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$54","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$55","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x117600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x15db200\" greater than 0x100000\n Raw size of \".text\" is \"0x334e00\" greater than 0x100000\n Raw size of \".text\" is \"0x109800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x11755c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x15db038\" greater than 0x100000\n Virtual size of \".text\" is \"0x334cd8\" greater than 0x100000\n Virtual size of \".text\" is \"0x10970c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"libssl-3-x64.dll\" has high imagebase \"0x180000000\"\n \"GoToResolveTools64.exe\" has high imagebase \"0x140000000\"\n \"GoToResolveUnlock64.dll\" has high imagebase \"0x180000000\"\n \"LMISupport7x64.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00004728-00000BC0-1867908738]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\timeout.exe\" [Source: 00000000-00003180-00000BC0-1869697833]\n Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00003180-00000C46-3012327522]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"devices-iot.console.gotoresolve.com\"\n \"devices.console.gotoresolve.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"GoToResolveUnattended.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$57","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" searching for window \"LogMeIn Resolve Unattended\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET / HTTP/1.1\nHost: devices-iot.console.gotoresolve.com\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$5c","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$5e","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000836.00000001.185126.00363000.00000002.mdmp, 00000000-00000836.00000001.185126.6F19B000.00000002.mdmp, 00000000-00000836.00000001.185126.6F5C7000.00000002.mdmp, 00000000-00000836.00000001.185126.705FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GoToResolveUnattended.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GoToResolveProcessChecker.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GoToResolveCrashHandler.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"g2rvdd.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$60","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$61","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" queries basic process information of the \"C:\\6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" (UID: 4728)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"GoToResolveUnattended.exe\" called \"NtQueueApcThread\" (UID: 00000000-00000836)\n \"GoToResolveProcessChecker.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001428)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$64","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"GoToResolveUnattended.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"GoToResolveUnattended.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"GoToResolveProcessChecker.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5\"\n \"GoToResolveProcessChecker.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5\"\n \"GoToResolveProcessChecker.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A\"\n \"GoToResolveProcessChecker.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" trying to access non-existent file \"C:\\6F980CF9CBEEE09B45BB913DDDA8159A30F1C285AC0BCF0DA9717FF6E0E49CF8.EXE.LOCAL\"\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\"\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\APPDATA\"\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\3506702571605499921\\EXTERNALMODULES\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\goto resolve installer\\goto0001.tmp\\unattendedupdater.log\"\n \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\goto resolve installer\\goto0001.tmp\\unattendedupdater.csv\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\GoTo Resolve Installer\\GoTo0001.tmp\\UnattendedUpdater.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"GoToResolveUnattended.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"30298e0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveUnattended.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"30223e0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2e9b470\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2e95f80\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"GoToResolveUnattended.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"30298e0\"\n \"lpReserved\": \"0\"}\n \"GoToResolveUnattended.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"30223e0\"\n \"lpReserved\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2e9b470\"\n \"lpReserved\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2e95f80\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /properties\"\n Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"6f980cf9cbeee09b45bb913ddda8159a30f1c285ac0bcf0da9717ff6e0e49cf8.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; File: \"00000000-00006496.00000000.185497.001E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000836.00000001.185126.06020000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6911060541c7d401f0028c7b"},{"report_type":"sandbox","report_id":"69106d41fe0ce21e160ffdf5"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"*ex!*@s$8mx.c]i