26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 78f0a7a59e4e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 78f0a7a59e4e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 9/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.IL.Trojan.MSILZilla.107313.10364.21294.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T949,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "ClrVirtualAllocWithinRange request #%u for %08x bytes in [ %p .. %p ], query count was %u - returned %s: %p" (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")28:T109d,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp")29:T4e0,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "UndoRevert/SetThreadToken failed for hToken = %d" (Indicator: "SetThreadToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcessToken"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")2a:T83a,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "g____PInvoke|2_0" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "LoadLibraryExWT" (Indicator: "LoadLibrary"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp")2b:Tc83,Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found reference to "AssemblyNative_GetHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to "Aes192" (Indicator: "Aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to "Aes128" (Indicator: "Aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to "HashAlgorithmType" (Indicator: "HashAlgorithm"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found reference to "AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found reference to "s_serverAuthOid" (Indicator: "Oid"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found reference to "s_clientAuthOid" (Indicator: "Oid"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found reference to "OidCollection" (Indicator: "Oid"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to "OidCollection" (Indicator: "OidCollection"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to "get_HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to "OidEnumerator" (Indicator: "Oid"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to "OidEnumerator" (Indicator: "OidEnumerator"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp")2c:T664,Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA050000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA0C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA0D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp")2d:T6a4,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GlobalizationNative_GetLocaleInfoGroupingSizes" (Indicator: "GetLocaleInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GlobalizationNative_GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GlobalizationNative_GetLocaleInfoString" (Indicator: "GetLocaleInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp")2e:T9d6,Found reference to API "GetAddrInfoExCancel" (Indicator: "getaddrinfo"; Source: "00000000-00004564-00000C2B-66698577") Found reference to API "GetAddrInfoExW" (Indicator: "getaddrinfo"; Source: "00000000-00004564-00000C2B-66701568") Found reference to API "g__Initialize|2_0" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "g__CompleteAsync|34_0" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "g____PInvoke|18_0" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "<g__CompleteAsync|34_0>d`1" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoW" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoExW" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "get_SupportsGetAddrInfoAsync" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoWithTelemetryAsync" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "s_getAddrInfoExSupported" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoExState" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoExCancel" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "TryGetAddrInfo" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "GetAddrInfoExContext" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "HSystem.Net.Dns+<g__CompleteAsync|34_0>d`1" (Indicator: "getaddrinfo"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp")2f:T148a,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004564) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003884) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003884)30:Tfd7,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")31:T1144,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\iphlpapi.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\winhttp.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\ws2_32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter C:\ucrtbase.dll (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "LoadLibrary" with a parameter ucrtbase.dll (UID: 00000000-00004564) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005636) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005636) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005636) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005636) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003884) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003884) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003884) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003884)32:T6436,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitializeContext2 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter QueueUserAPC2 (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatus (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetAddrInfoExCancel (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004564) "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004564) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005636) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003884) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003884)33:T4d0,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|10_0" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "StartWithCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "CreateProcessWT" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "CreateProcessWithLogonWT" (Indicator: "CreateProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")34:Tb46,Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "nvalidOperation_CantCreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "ValidateCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "CreateFileMappingWT" (Indicator: "CreateFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")35:T12c52,Found reference to API (Indicator: "OpenProcessToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RegOpenKeyExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ReportEventW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "EventWrite"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DeregisterEventSource"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSidSubAuthority"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RegQueryValueExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "OpenThreadToken"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RegCloseKey"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RegisterEventSourceW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "EventRegister"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RevertToSelf"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RegGetValueW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetTokenInformation"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualQuery"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DecodePointer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateMutexW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "HeapDestroy"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ResetEvent"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TlsFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CopyContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LocalFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CloseHandle"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ExitProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetFileSizeEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FindFirstFileExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateEventW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateFileMappingA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSystemInfo"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TlsAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetOverlappedResult"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ReleaseSemaphore"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlCaptureContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FlushInstructionCache"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ConnectNamedPipe"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetModuleHandleW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RaiseFailFastException"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetErrorMode"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "UnmapViewOfFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "QueryInformationJobObject"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "Sleep"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FormatMessageW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetFileSize"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LoadLibraryExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WaitForSingleObject"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LoadLibraryW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TlsGetValue"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RaiseException"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualProtect"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateFileW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ReleaseMutex"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SwitchToThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateProcessW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VerSetConditionMask"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InitializeContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetEvent"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ExitThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "HeapReAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "HeapAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "IsDebuggerPresent"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetModuleHandleExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ActivateActCtx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LoadLibraryA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FindNextFileW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "IsWow64Process"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "EnterCriticalSection"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RemoveDirectoryW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TerminateProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetExitCodeThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TlsSetValue"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetProcAddress"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LCMapStringEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCommandLineW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetStringTypeExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetProcessHeap"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetLastError"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DuplicateHandle"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCPInfo"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DebugBreak"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WideCharToMultiByte"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetFilePointer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSystemTime"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetFullPathNameW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentThreadId"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetTickCount64"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetStdHandle"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CancelIoEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetACP"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "MapViewOfFileEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateDirectoryW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "DeleteCriticalSection"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetStringTypeW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "OutputDebugStringA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FlushFileBuffers"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "RtlUnwind"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "QueueUserAPC"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "OutputDebugStringW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateNamedPipeA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LeaveCriticalSection"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SuspendThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "EncodePointer"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FreeLibrary"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetExitCodeProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetThreadPriority"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InitializeCriticalSection"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InitializeSListHead"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "MapViewOfFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SleepEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetLastError"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InterlockedFlushSList"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "IsProcessInJob"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "HeapCreate"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LocateXStateFeature"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ReadFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetModuleFileNameW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LoadLibraryExA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetFileAttributesExW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VirtualUnlock"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateActCtxW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetThreadContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetLargePageMinimum"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "OpenEventW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetTempPathW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ResumeThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SignalObjectAndWait"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "WriteFile"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadErrorMode"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetTickCount"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "HeapFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetCurrentProcessId"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "MultiByteToWideChar"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateFileMappingW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FindResourceW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetThreadPriority"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "FindClose"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateFileA"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SafeArrayPutElement"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SysAllocString"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "GetErrorInfo"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SysStringLen"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SysFreeString"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VariantChangeType"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VariantInit"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "VariantClear"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SysAllocStringLen"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "ShellExecuteW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "LoadStringW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "MessageBoxW"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoCreateGuid"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoUninitialize"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoGetClassObject"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoMarshalInterface"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoInitializeEx"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "CoTaskMemFree"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "SetServiceStatus"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC2"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile3"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc2"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadErrorMode"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "CreateMemoryResourceNotification"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "InitializeContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetXStateFeaturesMask"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CopyContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessGroupAffinity"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "CoReleaseMarshalData"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "VirtualUnlock"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetLargePageMinimum"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "IsProcessInJob"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIdOfThread"; Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "GetAcceptExSockaddrs"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API (Indicator: "GetNetworkParams"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryEx"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API (Indicator: "GetPerAdapterInfo"; Source: "00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistry"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp")36:Tbb6,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "seShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "NThe FileName property should not be a directory unless UseShellExecute is set." (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "2UseShellExecute is not supported on this platform." (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "ShellExecuteOnSTAThread" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "get_UseShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "k__BackingField" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "get_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "ShellExecuteFunction" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "ShellExecuteHelper" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")37:T86a,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp")38:T4e9,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|24_0" (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "GetOrOpenProcessHandle" (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")39:T542,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp")3a:T965,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\Classes\" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\dotnet" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "HKLM\" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "HKCU\" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "Software\Sysinternals\%s" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "Software\Microsoft\windows nt\currentversion" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "Software\Sysinternals" in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "HKLM\" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "HKCU\" in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Nod" in Source: 00000000-00004564.00000000.68337.D8570000.00000004.mdmp3b:T56f,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\advapi32.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\BCrypt.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\iphlpapi.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\winhttp.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\ole32.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" failed to load missing module "C:\ucrtbase.dll" - [base:0; Status:ffffffffc0000135]3c:T13af,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcd1ca0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcd1ca0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcd1ca0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "KERNEL32" at base 7ffcd3b70000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "KERNEL32.DLL" at base 7ffcd3b70000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "NTDLL" at base 7ffcd4b10000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffcd44e0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffcd0ef0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\ADVAPI32.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "ADVAPI32.DLL" at base 7ffcd37c0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\KERNEL32.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\BCRYPT.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "BCRYPT.DLL" at base 7ffcd09c0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcd18b0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\NTDLL.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "NTDLL.DLL" at base 7ffcd4b10000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\IPHLPAPI.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "IPHLPAPI.DLL" at base 7ffcd0420000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "RPCRT4.DLL" at base 7ffcd2230000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\WINHTTP.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "WINHTTP.DLL" at base 7ffccd1a0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffcb31a0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\OLE32.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "OLE32.DLL" at base 7ffcd4860000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\WS2_32.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "WS2_32.DLL" at base 7ffcd47f0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffcd06f0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "C:\UCRTBASE.DLL" at base 0 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "UCRTBASE.DLL" at base 7ffcd1ba0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffcbdb90000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffcc8ad0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffccc3b0000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffcbc530000 "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffcbbce0000 "cmd.exe" loaded module "KERNEL32" at base 7ffcd3b70000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcd1ca0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcd1ca0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcd1ca0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffcd4080000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcd1ca0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcd1ca0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcd1ca0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffcd3b70000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffcd4b100003d:T81a,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1420" "BaseAddress": "000001CDB5A30000" "Buffer": "000002A8704A6EB0" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\cmd.exe"} "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1420" "BaseAddress": "0000007BE315F2D8" "Buffer": "000000724FEEEC18" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1452" "BaseAddress": "0000015DDCE70000" "Buffer": "000002A870496DD0" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\cmd.exe"} "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1452" "BaseAddress": "0000003D860C42D8" "Buffer": "000000724FEEEC98" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "352" "BaseAddress": "0000023C14990000" "Buffer": "000001CDB7B66410" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\schtasks.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "352" "BaseAddress": "0000004FF55A42D8" "Buffer": "0000007BE32FE4F8" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\schtasks.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "352" "BaseAddress": "00000219E74C0000" "Buffer": "0000015DDEEC5750" "NumberOfBytesToWrite": "00000FB8" "$name": "C:\\Windows\\System32\\schtasks.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "352" "BaseAddress": "000000541E4BB2D8" "Buffer": "0000003D862FE118" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\schtasks.exe"}3e:T7e6,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "")3f:T128c,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BBBC81CF-E219-469C-A405-F820EE496194"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3333D2FC-3AEE-479F-985D-8BEBAE552B99"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "888489F6-5DDE-47B8-8506-E5BBC40E81D1"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "444290F4-897E-4602-8CE9-6FDAA3E4F26F"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0021D6B4-2084-4354-937B-937B604D7051"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3ADB16EA-848E-44DD-A424-51D82D573E04"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "76EDBA48-6A13-45B3-A291-2CF072F615D3"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6689DB7D-49B8-4772-8E6E-142015E0D1EB"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F31F7F37-EDE0-44CE-AB10-EB1D44E781BF"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0400AB69-E680-4E7F-BE61-43EBA565D8C0"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "0F8D6C73-6BD5-45AF-8F1F-19070A40439C"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8611FED5-D9D3-47F9-B095-3645BA4EEAF6"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "53E66965-FCFD-4CDA-A520-34FA34599A7F"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "86F30092-E00A-4BBA-8789-66450E720BEB"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F883EB01-AE8F-486B-82A0-077DF8F6101D"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "196A230F-7C17-4019-B2D9-71862D8F48C9"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBAD5978-C172-4AD7-A2FB-1DBD779684A5"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "4E887BED-1002-41E4-BA74-5AAF7C0EBC68"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "")40:T91f,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\sechost.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\bcryptprimitives.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\combase.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\win32u.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\user32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to touch file "C:\Windows\System32\gdi32.dll"41:Tb0e,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ADVAPI32.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\advapi32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\KERNEL32.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\kernel32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\BCRYPT.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\BCrypt.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\NTDLL.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ntdll.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\iphlpapi.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\WINHTTP.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\winhttp.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\OLE32.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ole32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\WS2_32.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ws2_32.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\UCRTBASE.DLL" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ucrtbase.dll" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\CMD.EXE" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\cmd.exe" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "cmd.exe"42:T774,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\INSTALL.RUNTIMECONFIG.DEV.JSON" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\Program Files (x86)\CORESERVICING" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,STATIC" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,STATIC,8.0.2" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,TASKSCHEDULER" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,MICROSOFT.DATA.SQLCLIENT.SNI.RUNTIME,5.1.1" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,MICROSOFT.DATA.SQLCLIENT.SNI.RUNTIME" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\NETCORE,TASKSCHEDULER,2.10.1" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" trying to access non-existent file "\Device\RasAcd"43:T4e9,Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "00000000-00004564-00000C2B-66597573") Found reference to API "andle:{0}, setsockopt():{1}" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "andle:{0} setsockopt():{1}" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|20_0" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|21_0" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|22_0" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "SetSockOpt" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "setsockopt" (Indicator: "setsockopt"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp")44:T4c9,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004564-00000C2B-66250948") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004564-00000C2B-66582350") Found reference to API "g____PInvoke|44_0" (Indicator: "WSARecv"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|49_0" (Indicator: "WSASend"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "g____PInvoke|185_0" (Indicator: "WinHttpOpen"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")45:T51a,Found reference to API "g____PInvoke|185_0" (Indicator: "WinHttpOpen"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "g____PInvoke|186_0" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "g____PInvoke|207_0" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "g____PInvoke|208_0" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")46:T1341,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004564-00000C2B-66582350") Found reference to API "D::TAUP: Claiming safety in shutdown mode.%d" (Indicator: " shutdown "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Cannot call Listen on a client connection" (Indicator: " listen "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Cannot call connect on a server connection" (Indicator: " connect "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Failed to connect to named pipe." (Indicator: " connect "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "ipc_stream_factory_build_and_add_port - Ignoring LISTEN port configuration" (Indicator: " listen "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "ds_ipc_stream_factory_get_next_available_stream - HUP :: Poll attempt: %d, connection %d hung up. Connect is reset." (Indicator: " connect "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Failed to connect to client connection" (Indicator: " connect "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Failed to send DiagnosticsIPC response" (Indicator: " send "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Failed to send advertise message" (Indicator: " send "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "Some locks to be taken during shutdown may already be orphaned!" (Indicator: " shutdown "; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "urrent Outgoing Connect Attempts" (Indicator: " connect "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "DAccepting into an existing Socket is not supported on this platform." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "NNone of the discovered or specified addresses match the socket address family." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "UCannot block a call on this socket while an earlier asynchronous call is in progress." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "F'{0}' Client can only accept InterNetwork or InterNetworkV6 addresses." (Indicator: " accept "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "aAn asynchronous socket operation is already in progress using this SocketAsyncEventArgs instance." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "Once the socket has been disconnected, you can only accept again asynchronously. BeginAccept must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "Once the socket has been disconnected, you can only accept again asynchronously. BeginAccept must be called on a thread that won't exit until the operation has been completed." (Indicator: " accept "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "Once the socket has been disconnected, you can only reconnect again asynchronously, and only to a different EndPoint. BeginConnect must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API ":The specified value for the socket information is invalid." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "?You must call the Bind method before performing this operation." (Indicator: " bind "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "AYou must call the Listen method before performing this operation." (Indicator: " listen "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "*The socket must not be bound or connected." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "CYou may not perform this operation after calling the Listen method." (Indicator: " listen "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found reference to API "/{0}: The socket must not be bound or connected." (Indicator: " socket "; Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp")47:Te7c,Heuristic match: "system.gc.name" Pattern match: "https://aka.ms/dotnet/download" Pattern match: "https://aka.ms/dotnet/info" Pattern match: "https://aka.ms/dotnet/app-launch-failedto" Pattern match: "https://aka.ms/dotnet/sdk-not-found" Pattern match: "https://aka.ms/dotnet-core-applaunch" Pattern match: "https://aka.ms/dotnet/app-launch-failed" Pattern match: "https://aka.ms/dotnet/app-launch-failedwould" Pattern match: "http://babuin73.lol/atmn/install.zip" Pattern match: "http://babuin73.lol/atmn/install.exe" Pattern match: "www.microsoft.com" Pattern match: "www.sysinternals.com" Pattern match: "https://aka.ms/nativeaot-compatibilit" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://www.hortcut" Pattern match: "http://iparticipation" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Pattern match: "http://www.c//dtd" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "uin73.lol/atmn/install.zip" Pattern match: "https://aka.ms/dotnet-warnings/{0" Pattern match: "https://github.com/dotnet/runtime" Heuristic match: "ns.question.name" Pattern match: "https://socks4:/" Heuristic match: "j.bn" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "babuin73.lol/atmn/install.zip" Pattern match: "babuin73.lol/atmn/install.exe" Pattern match: "https://aka.ms/binaryformatter" Pattern match: "https://aka.ms/dotnet-warnings/{0}n"48:T3436,Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/info" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-founddownload" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%s%sinstall" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?description:" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found URL "http://http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0zf;8>=:" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "http://www.microsoft.com0o;0z420240118031357.486z0washington1redmond1microsoft" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.700B0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp") Found URL "https://socks4:/" - Source: "00000000-00004564.00000000.68337.D60C0000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004564.00000000.68337.D8570000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.DA050000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.DA050000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found URL "http://gzip," - Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.DA210000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA240000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2233907" - Source: "00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-illink/com)$00000001-0000-0000-c000-000000000046$b196b28f-bab4-101a-b69c-00aa00341d07wrapnonexceptionthrowsserviceabletrueistrimmabletrueen-us.netcoreapp,version=v8.0frameworkdisplayname.net" - Source: "00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found URL "http://babuin73.lol:80/babuin73.lolws2_32.dllws2_32.dllws2_32.dllnameprivate.internaldiagnostics.system.net.socketsneteventsourceprivate.internaldiagnostics.system.net.socketsprivate.internaldiagnostics.system.net.socketsci.systsmen.tes.coekstnameprivate.internaldiagnostics.system.net.socketsws2_32.dllws2_32.dllnamesystem.net.socketssocketstelemetrysystem.net.socketssystem.net.socketsstsmen.tes.coekstnamesystem.net.socketsws2_32.dllkernel32.dllnamesystem.net.nameresolutionnameresolutiontelemetrysystem.net.nameresolutionsystem.net.nameresolutionnamesystem.net.nameresolutionws2_32.dllno" - Source: "00000000-00004564.00000000.68337.DD000000.00000004.mdmp")49:Te78,Found string "vailable HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ending HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "Total associated HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ax HTTP/1.1 connection limit:" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "o available HTTP/1.1 connections; request queued." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ound expired HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ound invalid HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ound usable HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "isposing HTTP/1.1 connection return to pool. Connection lifetime expired." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "equeued waiting HTTP/1.1 request." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "iscarding signaled HTTP/1.1 request waiter from queue." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "iscarding canceled HTTP/1.1 request from queue." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "ut HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "isposing HTTP/1.1 connection returned to pool. Pool was disposed." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "reating new HTTP/1.1 connection for pool." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "erver does not support HTTP2; disabling HTTP2 use and proceeding with HTTP/1.1 connection" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "owngrading queued HTTP2 request to HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "iscarding downgraded HTTP/1.1 connection because HTTP/1.1 connection limit is exceeded" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "*The HTTP/1.1 response chunk was too large." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "The synchronous method is not supported by '{0}' for HTTP/2 or higher. Either use an asynchronous method or downgrade the request version to HTTP/1.1 or lower." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")4a:T105b,Found string "EnableAES" (Indicator: "aes"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found string "EnableAES" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "ncompletaestudiosp" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp") Found string "aesenc" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aesdeclast" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aesdec" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aeskeygenassist" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aesimc" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "aesenclast" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "NYI: Implement AES intrinsic code generation" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "Aes192" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "Aes192" (Indicator: "aes192"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "Aes256" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "Aes256" (Indicator: "aes256"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "Aes128" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "Aes128" (Indicator: "aes128"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp") Found string "AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found string "CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp") Found string "AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp")4b:T967,Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "g____PInvoke|25_0" (Indicator: "EnumProcesses"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "K32EnumProcessesT" (Indicator: "EnumProcesses"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")4c:T704,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "g____PInvoke|13_0" (Indicator: "RegQueryValue"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "RegOpenKey"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegQueryValueEx" (Indicator: "RegQueryValue"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegOpenKeyExWTU" (Indicator: "RegOpenKey"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp") Found reference to API "RegQueryValueExWTU" (Indicator: "RegQueryValue"; Source: "00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp")4d:T9e1,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")4e:T582,file/memory contains long string with (Indicator: "password"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.70A00000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found string "jStarting a process as another user with a specified password and domain is not supported on this platform." (Indicator: "password"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found string "=Invalid URI: The username:password construct is badly formed." (Indicator: "password"; Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found string ":SOCKS server requested username & password authentication." (Indicator: "password"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")4f:T5f7,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|7_0" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp") Found reference to API "LookupPrivilegeValueWT" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004564.00000000.68337.709E0000.00000002.mdmp")50:T86c,Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp")51:T44b,Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeIncreaseWorkingSetPrivilege" (Indicator: "SeIncreaseWorkingSetPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeTimeZonePrivilege" (Indicator: "SeTimeZonePrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "gSeTcbPrivilege" (Indicator: "SeTcbPrivilege"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp")52:T984,"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "")53:T4ad,Found string "An exception occurred during a Ping request" (Indicator: "ping"; File: "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f") Found string "Canary failed to create ping event. gle=%d" (Indicator: "ping"; Source: "00000000-00004564.00000000.68337.35D98000.00000002.mdmp") Found string "hostName" (Indicator: "hostname"; Source: "00000000-00004564.00000000.68337.70860000.00000002.mdmp") Found string ".Invalid URI: The hostname could not be parsed." (Indicator: "hostname"; Source: "00000000-00004564.00000000.68337.70A00000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp") Found string "eceived PING frame, content:" (Indicator: "ping"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "FlowControl] Sending RTT PING with payload" (Indicator: "ping"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "FlowControl] Unexpected PING ACK in state" (Indicator: "ping"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp") Found string "FlowControl] Unexpected RTT PING ACK payload" (Indicator: "ping"; Source: "00000000-00004564.00000000.68337.DA120000.00000002.mdmp")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791714968210,"unified_at":"2026-10-11T10:36:08.210Z","metadata":{"hashes":{"sha256":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","sha1":"e02b11784403322b391b2c68b80c67331669396e","md5":"14a623ff8e460b9c66ada3ac8c46ced9","sha512":"73d704cac2e0c6ac45c7ee8237003ac3431a730cb7ff0b13bc1c84b08b6f2b253190136f5893d496e0562608cdea5aca08ae47288c1b162758a4646022deb55d","ssdeep":"393216:+G251FGAsxevRZx3Iev6xALRadLxlkux8Ei++90R5X:+D1Ftx3exl8H++90nX","ssdeep_chunks":["393216:+G251FG","393216:G251FGA","393216:251FGAs","393216:51FGAsx","393216:1FGAsxe","393216:FGAsxev","393216:GAsxevR","393216:AsxevRZ","393216:sxevRZx","393216:xevRZx3","393216:evRZx3I","393216:vRZx3Ie","393216:RZx3Iev","393216:Zx3Iev6","393216:x3Iev6x","393216:3Iev6xA","393216:Iev6xAL","393216:ev6xALR","393216:v6xALRa","393216:6xALRad","393216:xALRadL","393216:ALRadLx","393216:LRadLxl","393216:RadLxlk","393216:adLxlku","393216:dLxlkux","393216:Lxlkux8","393216:xlkux8E","393216:lkux8Ei","393216:kux8Ei+","393216:ux8Ei++","393216:x8Ei++9","393216:8Ei++90","393216:Ei++90R","393216:i++90R5","393216:++90R5X","786432:+G251FG","786432:G251FGA","786432:251FGAs","786432:51FGAsx","786432:1FGAsxe","786432:FGAsxev","786432:GAsxevR","786432:AsxevRZ","786432:sxevRZx","786432:xevRZx3","786432:evRZx3I","786432:vRZx3Ie","786432:RZx3Iev","786432:Zx3Iev6","786432:x3Iev6x","786432:3Iev6xA","786432:Iev6xAL","786432:ev6xALR","786432:v6xALRa","786432:6xALRad","786432:xALRadL","786432:ALRadLx","786432:LRadLxl","786432:RadLxlk","786432:adLxlku","786432:dLxlkux","786432:Lxlkux8","786432:xlkux8E","786432:lkux8Ei","786432:kux8Ei+","786432:ux8Ei++","786432:x8Ei++9","786432:8Ei++90","786432:Ei++90R","786432:i++90R5","786432:++90R5X","393216:+D1Ftx3","393216:D1Ftx3e","393216:1Ftx3ex","393216:Ftx3exl","393216:tx3exl8","393216:x3exl8H","393216:3exl8H+","393216:exl8H++","393216:xl8H++9","393216:l8H++90","393216:8H++90n","393216:H++90nX"],"imphash":"b819c89ac9b569d0bbb77889674017b2"},"file_info":{"file_name":"SecuriteInfo.com.IL.Trojan.MSILZilla.107313.10364.21294.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":23771662,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1710837922000,"last_seen":1753173085000,"last_multi_scan":1753173085000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":163,"suspicious_count":17,"malicious_count":8,"total":188},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.wrfoe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.FQRBDZG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!C4968EF3848A0C57","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0001140e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.PTPG-1982","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.CHQT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed from task XML file"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"},{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to delete scheduled tasks"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"suspicious","value":"YARA signature match - Cyclic XOR decryption routine for 64 bit samples"},{"type":"suspicious","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"malicious","value":"YARA signature match – RiskTool.PsExec"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"suspicious","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains ability to use SMTP [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Remote Desktop Software","attack_id":"T1219.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1219/002","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService failed - %s\" (Indicator: \"OpenService\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00004564.00000000.68337.35D98000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2c","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\%s-%s-%d-stdin; Source: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string - \\\\.\\pipe\\%s-%s-%d-stdout; Source: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string - \\\\.\\pipe\\%s-%s-%d-stderr; Source: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string - \\\\.\\pipe\\%s; Source: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string - \\\\.\\pipe\\dotnet-diagnostic-4564; Source: \"00000000-00004564-00000C56-64515867\")\n Found string - \\\\.\\pipe\\%s; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found string - \\\\.\\pipe\\dotnet-diagnostic-%d; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found string - \\\\.\\pipe\\dotnet-diagnostic-4564; Source: \"00000000-00004564.00000000.68337.D8570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Error reading public key length from PsExec services:\" (Indicator: \"public key\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"Error reading public key from PsExec service:\" (Indicator: \"public key\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"Error importing public key:\" (Indicator: \"public key\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"{0}' not selected because it doesn't have a private key.\" (Indicator: \"private key\"; Source: \"00000000-00004564.00000000.68337.70430000.00000002.mdmp\")\n Found string \"kipping current X509Certificate2 {0} since it doesn't have private key. Certificate Subject: {1}, Thumbprint: {2}.\" (Indicator: \"private key\"; Source: \"00000000-00004564.00000000.68337.DA120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"] ^ a d\" (Indicator: \" ^ \"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64 bit samples\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64 bit samples\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64 bit samples\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains references to network communication API (string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp, 00000000-00004564.00000000.68337.70A00000.00000002.mdmp, 00000000-00004564.00000000.68337.DA050000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004564-00000C2B-65675233\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004564)\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"IsWow64Process\" with parameter \"4564\" - (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"AssemblyNative_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"ThrowGetVersionException\" (Indicator: \"GetVersion\"; Source: \"00000000-00004564.00000000.68337.DA120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManager failed - %s\" (Indicator: \"OpenSCManager\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\dotnet-diagnostic-4564\"\n dwOpenMode: \"1074266115\"\n dwPipeMode: \"8\" - (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /c schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f\" - (UID: 00000000-00004564)\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /c schtasks /create /xml \"%WINDIR%\\ShellExperiences\\security\\ScheduledDefrag.xml\" /tn \"Microsoft\\Windows\\Bluetooth\\Sch\" - (UID: 00000000-00004564), \"cmd.exe\" called \"CreateProcessW\" with parameter \"schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f\" - (UID: 00000000-00005636), \"cmd.exe\" called \"CreateProcessW\" with parameter \"schtasks /create /xml \"%WINDIR%\\ShellExperiences\\security\\ScheduledDefrag.xml\" /tn \"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\" - (UID: 00000000-00003884)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-4564\" - (UID: 00000000-00004564)\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"AssemblyNative_GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"g____PInvoke|1_0\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")\n Found reference to API \"RegConnectRegistry\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")\n Found reference to API \"RegConnectRegistryWTU\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"LoadResource error: %x\" (Indicator: \"LoadResource\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"ProcessStartInfo.LoadUserProfile and ProcessStartInfo.UseCredentialsForNetworkingOnly cannot both be set. Use only one of them.\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"k__BackingField\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"get_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"-Command \"Invoke-Command -ComputerName\" (Indicator: \"Invoke-Command\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetShowWindowFromWindowStyle\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartService\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" contains export function called \"CLRJitAttachState\" at ordinal 3\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" contains export function called \"DotNetRuntimeInfo\" at ordinal 4\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" contains export function called \"MetaDataGetDispenser\" at ordinal 5\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" contains export function called \"g_CLREngineMetrics\" at ordinal 2\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" contains export function called \"g_dacTable\" at ordinal 6","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%s-%s-%d-stdin\n Found string - \\\\.\\pipe\\%s-%s-%d-stdout\n Found string - \\\\.\\pipe\\%s-%s-%d-stderr\n Found string - \\\\.\\pipe\\%s\n Found string - \\\\.\\pipe\\dotnet-diagnostic-4564\n Found string - \\\\.\\pipe\\dotnet-diagnostic-%d","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D18B0000\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D09C0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D18B0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D18B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2230000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2230000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2230000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7e1d1fc7f0000@ntdll.dll\"\n \"220023000000000018c7e1d1fc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has an executable section named \".text\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has an executable section named \".CLR_UEF\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has an writable section named \".data\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has an writable section named \".didat\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has an writable section named \"Section\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1405c955c,add\trsp, 0x28,jmp\t0x1405c8fcc,int3\t,int3\t,sub\trsp, 0x28,call\t0x1402ba290,jmp\t0x1405c9171,xor\teax, eax,add\trsp, 0x28,ret\t,int3\t,int3\t,jmp\t0x1405c9164,int3\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tqword ptr [rsp + 0x18], rsi,push\trdi,sub\trsp, 0x10,xor\teax, eax,xor\tecx, ecx,cpuid\t,mov\tr8d, ecx,xor\tr11d, r11d,mov\tr10d, edx,xor\tr8d, 0x6c65746e,xor\tr10d, 0x49656e69,mov\tr9d, ebx,mov\tesi, eax,xor\tecx, ecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x615800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x17d400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x147000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x6156cc\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x17d352\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x146ebc\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00004564-00000BC0-69125822]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00005636-00000BC0-70284411]\n Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00005636-00000C46-2569870926]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00005636) was launched with new environment variables: \"USERDNSDOMAIN=\"HFL7saiPTznHl8L\"\"\n Process \"cmd.exe\" (UID: 00000000-00005636) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"schtasks.exe\" (UID: 00000000-00001108) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"babuin73.lol\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\Schedul ...\" (UID: 00000000-00005636)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ ...\" (UID: 00000000-00003884), Spawned process \"schtasks.exe\" with commandline \"schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\Scheduled ...\" (UID: 00000000-00001108), Spawned process \"schtasks.exe\" with commandline \"schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\Sc ...\" (UID: 00000000-00006388)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\Schedul ...\" (UID: 00000000-00005636)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ ...\" (UID: 00000000-00003884), Spawned process \"schtasks.exe\" with commandline \"schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\Scheduled ...\" (UID: 00000000-00001108), Spawned process \"schtasks.exe\" with commandline \"schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\Sc ...\" (UID: 00000000-00006388)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$3d","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService failed - %s\" (Indicator: \"CreateService\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" queries basic process information of the \"C:\\78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (UID: 4564)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$43","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"g____PInvoke|44_0\" (Indicator: \"WSARecv\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|49_0\" (Indicator: \"WSASend\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|67_0\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"CreatePipeWithSecurityAttributes\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"andle:{0}, setsockopt():{1}\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"andle:{0} setsockopt():{1}\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|20_0\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|21_0\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|22_0\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|19_0\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use SMTP [Dotnet Namespaces]","description":"Found reference to \"_singleBufferReceiveEventArgs\" (Indicator: \"ReceiveEventArgs\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to \"_multiBufferReceiveEventArgs\" (Indicator: \"ReceiveEventArgs\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-617","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"2.10.1.0\"\n \"08.63.11.84\"\n \"01.00.00.02\"\n \"8.0.0.0\"\n \"27.0.0.1\"\n Potential IP \"0.0.0.0\" found in string \"lIPv4 address 0.0.0.0 and IPv6 address ::0 are unspecified addresses that cannot be used as a target address.\"\n \"17.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00004564\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"et_log_listener_no_spn_kerberos\"\" (Indicator: \"kerberos\"; Source: \"00000000-00004564.00000000.68337.DA240000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"4783235060,7060,3181,,GetAdaptersAddresses,Iphlpapi.dll,\"00:17:44.906\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004564.00000000.68337.6FEB0000.00000004.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddressesFlags\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004564.00000000.68337.DA0A0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"k__BackingField\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00004564.00000000.68337.70A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"5528559362,7060,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:45.218\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004564.00000000.68337.6FEB0000.00000004.mdmp\")\n Found reference to API \"6300365881,7976,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:45.546\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004564.00000000.68337.6FEB0000.00000004.mdmp\")\n Found reference to API \"6308272355,7976,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:45.546\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004564.00000000.68337.6FEB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|35_0\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp, 00000000-00004564.00000000.68337.70860000.00000002.mdmp, 00000000-00004564.00000000.68337.DA120000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariablesBlock\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"g____PInvoke|5_0\" (Indicator: \"getsockname\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004564.00000000.68337.700B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"MarshalNative_GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|6_0\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found string \"g____PInvoke|24_0\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found string \"g____PInvoke|6_0\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found string \"GetOrOpenProcessHandle\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\LanmanRedirector\\%s\\ipc$\" (Indicator: \"\\Device\\\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"e\\Device\\Srv2\" (Indicator: \"\\Device\\\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \"\\Device\\LanmanServer\" (Indicator: \"\\Device\\\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004564.00000000.68337.D8570000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004564.00000000.68337.D8570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"g____PInvoke|10_0\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004564.00000000.68337.709E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004564.00000000.68337.700B0000.00000002.mdmp\n 00000000-00004564.00000000.68337.DA120000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004564.00000000.68337.70430000.00000002.mdmp\n 00000000-00004564.00000000.68337.DA1C0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"SafeExitProcess: exitCode = %d sca = %d\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"In EEPolicy::HandleExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp, 00000000-00004564.00000000.68337.35F6F000.00000002.mdmp, 00000000-00004564.00000000.68337.DA0E0000.00000002.mdmp, 00000000-00004564.00000000.68337.DA210000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"8131892426FBDB0100000000000000000000000002000000\")\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"45F68D2426FBDB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: 78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004564.00000000.68337.35D98000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has section name .text with entropy \"6.454005400851845\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has section name .pdata with entropy \"6.4934318207300405\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has section name .rsrc with entropy \"6.36010393687884\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"g____PInvoke|8_0\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp\")\n Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00004564.00000000.68337.70430000.00000002.mdmp, 00000000-00004564.00000000.68337.DA240000.00000002.mdmp, 00000000-00004564.00000000.68337.DA3A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00004564)\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00004564)\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00004564)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Cyclic XOR decryption routine for 64 bit samples","description":"YARA signature to detect cyclic XOR decryption routine for 64 bit samples file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-599","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect psexec RMM tool file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1219.002","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"sample.bin\"\n YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_TOOL_WEDGECUT\" matched file \"sample.bin\" as \"Detects WEDGECUT a reconnaissance tool to checks hosts are online using ICMP packets\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"\"cmd.exe\" /c schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00004564-00000C46-12401076843\")\n Found string \"/c schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f\" (Indicator: \"schtasks /delete\"; File: \"cmd.exe\")\n Found string \"c schtasks /delete /tn \"\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\"), Found string \"c schtasks /delete /tn \"\"\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00004564.00000000.68337.DA1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"E:\\source\\install3\\steam\\bin\\Debug\\net8.0\\steam.exe\" with delete access\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"D:\\Games\\Steam\\steam.exe\" with delete access\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"D:\\Launchers\\Steam\\steam.exe\" with delete access\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"D:\\Steam\\steam.exe\" with delete access\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"C:\\GAMES\\STEAM\\STEAM.EXE\" with delete access\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" opened \"E:\\Games\\Steam\\steam.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"8131892426FBDB0100000000000000000000000002000000\")\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"45F68D2426FBDB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a TLS callback with entrypoint at 0x405c85e0\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a TLS callback with entrypoint at 0x1\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a TLS callback with entrypoint at 0x405c8da0","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegOpenKeyExW\n RegCloseKey\n SetKernelObjectSecurity\n SleepConditionVariableSRW\n VirtualAlloc\n GetFileSizeEx\n FindFirstFileExW\n CreateThreadpoolTimer\n CreateFileMappingA\n GetSystemInfo\n UnhandledExceptionFilter\n ConnectNamedPipe\n GetModuleHandleW\n Sleep\n GetFileSize\n LoadLibraryExW\n LoadLibraryW\n VirtualProtect\n CreateFileW\n CreateProcessW\n ExitThread\n DisconnectNamedPipe\n IsDebuggerPresent\n GetModuleHandleExW\n LoadLibraryA\n FindNextFileW\n TerminateProcess\n GetProcAddress\n GetCommandLineW\n VirtualAllocExNuma\n GetTickCount64\n MapViewOfFileEx\n CreateDirectoryW\n OutputDebugStringA\n OutputDebugStringW\n MapViewOfFile\n SleepEx\n CreateThread\n GetModuleFileNameW\n LoadLibraryExA\n GetFileAttributesExW\n GetThreadContext\n GetTempPathW\n WriteFile\n GetTickCount\n CreateFileMappingW\n FindResourceW\n CreateFileA\n ShellExecuteW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a section named \".CLR_UEF\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a section named \".didat\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a section named \"Section\"\n \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (DLL) (GUI) x86-64\n for MS Windows\n 7 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at CC800000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ScheduledDefrag.xml\" /tn \"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\" /RU SYSTEM\" (UID: 00000000-00006388)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ScheduledDefrag.xml\" /tn \"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\" /RU SYSTEM\" (UID: 00000000-00006388)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – RiskTool.PsExec","description":"YARA signature RiskTool.PsExec matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1570","relevance":9,"id":"yara-2","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\"\" /f\" (UID: 00000000-00001108)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe\" (UID: 00000000-00004564)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\"\" /f\" (UID: 00000000-00005636)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ScheduledDefrag.xml\" /tn \"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\" /RU SYSTEM\" (UID: 00000000-00003884)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /delete /tn \"\"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\"\" /f\" (UID: 00000000-00001108)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /xml \"%WINDIR%\\\\ShellExperiences\\\\security\\\\ScheduledDefrag.xml\" /tn \"Microsoft\\\\Windows\\\\Bluetooth\\\\ScheduledDefrag\" /RU SYSTEM\" (UID: 00000000-00006388)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Tries to delete scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","TOR analysis"],"sandbox_reports":[{"id":"687f4c5b5aa142818a028dbe","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","analysis_start_time":"2025-07-22T09:31:22+00:00","indicators_count":{"informative":164,"suspicious":32,"malicious":8},"tags":["Multi-Process","Network Traffic","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"babuin73.lol","country":"-","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}],"processes":[{"pid":4564,"ppid":0,"name":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe","command_line":"","sha256":"78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f","normalized_path":"C:\\78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f.exe","uid":"00000000-00004564","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5636,"ppid":4564,"name":"cmd.exe","command_line":"/c schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00004564","uid":"00000000-00005636"},{"pid":1108,"ppid":5636,"name":"schtasks.exe","command_line":"schtasks /delete /tn \"\"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\"\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005636","uid":"00000000-00001108"},{"pid":3884,"ppid":4564,"name":"cmd.exe","command_line":"/c schtasks /create /xml \"%WINDIR%\\ShellExperiences\\security\\ScheduledDefrag.xml\" /tn \"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\" /RU SYSTEM","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00004564","uid":"00000000-00003884"},{"pid":6388,"ppid":3884,"name":"schtasks.exe","command_line":"schtasks /create /xml \"%WINDIR%\\ShellExperiences\\security\\ScheduledDefrag.xml\" /tn \"Microsoft\\Windows\\Bluetooth\\ScheduledDefrag\" /RU SYSTEM","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003884","uid":"00000000-00006388"}],"all_imported_dlls":["profapi.dll","imm32.dll","bcrypt.dll","OnDemandConnRouteHelper.dll","KernelBase.dll","advapi32.dll","msvcrt.dll","ole32.dll","rasadhlp.dll","taskschd.dll","ntdll.dll","sechost.dll","win32u.dll","windows.storage.dll","cryptsp.dll","dhcpcsvc.dll","apphelp.dll","dnsapi.dll","mswsock.dll","NapiNSP.dll","sspicli.dll","kernel32.dll","oleaut32.dll","VxSSL64.dll","ws2_32.dll","fltLib.dll","nsi.dll","nlaapi.dll","shlwapi.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","winhttp.dll","bcryptprimitives.dll","msvcp_win.dll","cfgmgr32.dll","SHCore.dll","winnsi.dll","pnrpnsp.dll","clbcatq.dll","rpcrt4.dll","combase.dll","ucrtbase.dll","shell32.dll","kernel.appcore.dll","winrnr.dll","gdi32.dll","gdi32full.dll","user32.dll","powrprof.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.2","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,TaskScheduler","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Data.SqlClient.SNI.runtime,5.1.1","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Data.SqlClient.SNI.runtime","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,TaskScheduler,2.10.1","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"687f4c5b5aa142818a028dbe"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["687f4c5b5aa142818a028dbe"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 78f0a7a59e4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 78f0a7a59e4e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 9/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 78f0a7a59e4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 78f0a7a59e4e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 9/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 78f0a7a59e4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 78f0a7a59e4e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 9/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]]