34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 81:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 83c52d961abc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 83c52d961abc…. Malware family: Crifi.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 7 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f"],"about":{"@type":"SoftwareApplication","name":"f799c0bef42a0b0ac9271f9a8a7e30ee.exe","applicationCategory":["peexe","executable"],"identifier":"83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T78c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")37:T4d3,"" (Indicator: "RegSetValue"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")3c:T473,Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")3d:T62e,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp")3e:T5f6,"7rm1WY61.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}") "7rm1WY61.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "7rm1WY61.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "7rm1WY61.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "7rm1WY61.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "7rm1WY61.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG")3f:T96e,"" (Indicator: "enumchildwindows"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")47:T2c77,"" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry modification API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry modification API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry modification API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry modification API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry modification API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry modification API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry modification API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry modification API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry modification API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry modification API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry modification API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00005492.00000001.106170.013BA000.00000002.mdmp" Found registry modification API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry modification API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry modification API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry modification API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00007488.00000001.106591.000AA000.00000002.mdmp"4f:T112e,Found string "" (Indicator: "MoveFileA"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp")50:Te04,"" (Indicator: "CreateProcess"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.003F0000.00000004.mdmp, 00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.003F0000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "ER=ElevateCreateProcess WRPMiti%" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "BasepReleaseSxsCreateProcessUtilityStruct" (Indicator: "CreateProcess"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.03070000.00000004.mdmp, 00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.03070000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "ER=ElevateCreateProcess WRPMitiT" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp")53:Td28,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")54:T691,Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp") Found reference to API "yncShellExecute[" (Indicator: "ShellExecute"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp")55:T828,Found reference to API "LockResource" (Indicator: "LockResource"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")56:T11ce,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp")57:T4ce,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp")58:T561,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")59:T5b9,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")5a:Ta60,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin "DSystem\CurrentControlSet\Control\Session Manager" in Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin "System\CurrentControlSet\Control\Session Manager" in Source: 25015-17-0040256D "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp 00000000-00003184.00000001.106583.0347F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005492.00000000.105594.013B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007488.00000001.106591.000A1000.00000020.mdmp5b:Taa4,"stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003184.00000000.106496.03400000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003184.00000001.106583.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003184.00000001.106583.0347F000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005492.00000000.105594.013B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007488.00000001.106591.000A1000.00000020.mdmp5c:T1541,"" (Indicator: "GetDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp")6a:Tcca,Found registry query API: "RegQueryInfoKeyA" in file "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin" Found registry query API: "RegQueryValueExA" in file "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin" Found registry query API: "RegOpenKeyExA" in file "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin" Found registry query API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry query API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry query API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry query API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry query API: "RegOpenUserClassesRoot" in "00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry query API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry query API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry query API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry query API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005492.00000001.106170.013BA000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005492.00000001.106170.013BA000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005492.00000001.106170.013BA000.00000002.mdmp" Found registry query API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry query API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007488.00000001.106591.000AA000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00007488.00000001.106591.000AA000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007488.00000001.106591.000AA000.00000002.mdmp"6b:Tfea,Found string "FromBase64" (Indicator: "base64"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.054B0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.054B0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.054B0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.054B0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.05C40000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.05C40000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.05C40000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003184.00000000.106496.05C40000.00000002.mdmp") Found string "BasepSetFileEncryptionCompression" (Indicator: "fileencrypt"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp")6c:T780,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")6d:T1176,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp, 00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004812.00000000.106098.0005D000.00000004.mdmp, 00000000-00004812.00000001.106162.0005D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp")6e:T696,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")6f:T73a,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")70:Tf96,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")71:T484,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")72:T529,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")73:T983,Found registry deletion API: "RegDeleteValueA" in file "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin" Found registry deletion API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry deletion API: "" in "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00005492.00000001.106170.013BA000.00000002.mdmp" Found registry deletion API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry deletion API: "" in "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00007488.00000001.106591.000AA000.00000002.mdmp"74:Tb23,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\1VC50aN9.exe" (Indicator: "\Device\"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007488.00000001.106591.02700000.00000004.mdmp")75:Te68,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "32833598538,6128,3136,,RemoveDirectoryA,kernel32.dll,"00:27:38.843",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "51347297806,7344,3136,,RemoveDirectoryA,kernel32.dll,"00:27:45.453",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00007488.00000001.106591.02700000.00000004.mdmp")76:T8f7,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005492.00000000.105594.013B1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005492.00000000.105594.013B1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007488.00000001.106591.000A1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007488.00000001.106591.000A1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")77:Tb50,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")78:T12c7,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003184.00000000.106496.03400000.00000004.mdmp, 00000000-00003184.00000001.106583.03400000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003220.00000000.105653.00880000.00000004.mdmp, 00000000-00003220.00000001.105773.00880000.00000004.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004812.00000000.106098.030C0000.00000004.mdmp, 00000000-00004812.00000001.106162.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005492.00000000.105594.03560000.00000004.mdmp, 00000000-00005492.00000001.106170.03560000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00007488.00000000.105493.02700000.00000004.mdmp, 00000000-00007488.00000001.106591.02700000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")79:T97c,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003220.00000000.105653.00ED1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003184.00000000.106496.0040F000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003220.00000000.105653.00EE5000.00000002.mdmp, 00000000-00003220.00000000.105653.00EED000.00000004.mdmp, 00000000-00003220.00000001.105773.00EED000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004812.00000000.106098.00055000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005492.00000001.106170.013BA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007488.00000001.106591.000AA000.00000002.mdmp")7a:T83b,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 83c52d961abc1e1a65d313bf1592cd1ffc61c11e96eb9d6d2e7145d3f2d4cf1f.bin] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: FW9NL23.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: FW9NL23.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: FW9NL23.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: FW9NL23.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: FW9NL23.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 2ap1616.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 2ap1616.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1VC50aN9.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 1VC50aN9.exe]7b:T943," Microsoft Corporation\"\n \"1VC50aN9.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7rm1WY61.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69bae847fbab7dbcc009cf4c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"