24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HackTool/ConnectWiseControl.i Sample 8b5f89e88b40… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b5f89e88b40…. Malware family: HackTool/ConnectWiseControl.i. Threat score 100/100. 3/27 AV engines flagged this file. 6 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1","keywords":["Malicious","HackTool/ConnectWiseControl.i","malware analysis","sandbox report","threat intelligence","8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1"],"about":{"@type":"SoftwareApplication","name":"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin","applicationCategory":["peexe","executable"],"identifier":"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"HackTool/ConnectWiseControl.i","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T588,file/memory contains long string(File: "Microsoft.Deployment.WindowsInstaller.Package.dll") file/memory contains long string(File: "Microsoft.Deployment.Compression.Cab.dll") file/memory contains long string(File: "Microsoft.Deployment.Compression.dll") Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found string "urrent implementation of free space compression does not support version 4 of Compound File Format" (Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found string "ZipFile" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "ZSTD_c_compressionLevel" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "decompressionStream" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "compressionStrategy" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "??\c:\users\hapubws\appdata\local\temp\msi6eca.tmp-\microsoft.deployment.compression.cab.dll" (Source: "00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "??\c:\users\hapubws\appdata\local\temp\msi6eca.tmp-\microsoft.deployment.compression.dll" (Source: "00000000-00004212.00000001.165742.03530000.00000004.mdmp")26:T9a5,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "ScreenConnect.WindowsInstaller.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.dll"27:T66d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp")28:T536,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp")29:T1c7a,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMAC"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMACSHA256"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "DeriveBytesIterations" (Indicator: "DeriveBytes"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to ", HashAlgorithmName =" (Indicator: "HashAlgorithm"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "SHA384" (Indicator: "SHA384"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "SHA512" (Indicator: "SHA512"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp")2a:T659,"k__BackingField" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "k__BackingField" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "k__BackingField" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "k__BackingField" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_MachineName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_MachineName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_UserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_UserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_StoredUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_StoredUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_OptionalUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_OptionalUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_LoggedOnUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_LoggedOnUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "domainUserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "WindowsDomainUserNameToString" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_CredentialProviderUserNameFormat" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_CredentialProviderUserNameFormat" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "UserName" (Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp")30:T22d4,"" (Indicator: "CreateProcess"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp")39:T9561,Found reference to API (Indicator: "FindResourceW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetStdHandle"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "TlsGetValue"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetOEMCP"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetFileType"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "ExitProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "HeapFree"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "TerminateProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FindNextFileA"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "CloseHandle"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "TlsFree"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FreeLibrary"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FindClose"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "TlsAlloc"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "HeapAlloc"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LockResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "CreateFileW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "HeapSize"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "RaiseException"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetLastError"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "WriteFile"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetProcAddress"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetStdHandle"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "EncodePointer"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetLastError"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LCMapStringW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "TlsSetValue"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SizeofResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetACP"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FindFirstFileExA"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCPInfo"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "RtlUnwind"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "DecodePointer"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "VariantInit"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "VariantClear"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SafeArrayAccessData"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FlsAlloc"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FlsFree"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FlsGetValue"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "FlsSetValue"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetEnvironmentVariable"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "CopyFile"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetVersion"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SetCursor"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "GetObject"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "SeDebugPrivilege"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00004212.00000000.165716.00131000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07B02000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "FatalExit"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceEx"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryEx"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "BeginUpdateResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp")3a:Tfdf,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "b__2_0" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "b__3_0" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "b__1" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadResourcePack" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadResourcesFromStream" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadResourcePacks" (Indicator: "LoadResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "WindowsNative.SizeofResource(handle, resourceInformationBlockPtr)" (Indicator: "SizeofResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "WindowsNative.LockResource(dataHandle)" (Indicator: "LockResource"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "FindResourceEx" (Indicator: "FindResource"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "indowsNative.FindResource(handle, WindowsInstallerConstants.CustomPayloadResourceName, WindowsInstallerConstants.CustomPayloadResourceType)" (Indicator: "FindResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "indowsNative.LoadResource(handle, resourceInformationBlockPtr)" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "indowsNative.SizeofResource(handle, resourceInformationBlockPtr)" (Indicator: "SizeofResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "indowsNative.LockResource(dataHandle)" (Indicator: "LockResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "FindResource" (Indicator: "FindResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004212.00000000.165716.07A32000.00000002.mdmp") Found reference to API "b__2_0" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API "b__3_0" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API "b__1" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API "LoadResourcePack" (Indicator: "LoadResource"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp")3b:T1135,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "MsiGetLastErrorRecord" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API ",Error getting volume info. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "=Error getting disk free space. GetLastError: [2]. Volume: [3]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "2Error waiting for patch thread. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "ACould not create thread for patch application. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "3Error setting file attribute: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "*Could not open file: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "7Could not get file time for file: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "1Could not remove directory: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "+Error deleting file: [3]. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "5Error getting file attributes: [3]. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "0Error getting file attributes. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "0Error setting file attributes. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "IError converting file time to local time for file: [3]. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "8Error creating temp file on path: [3]. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "+Could not close file: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "9Could not update resource for file: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "7Could not set file time for file: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "@Error determining whether file is in-use: [3]. GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "4Could not apply patch to file [2]. GetLastError: [3]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp") Found reference to API "bPatch file [2] is corrupt or of an invalid format. Attempting to patch file [3]. GetLastError: [4]" (Indicator: "GetLastError"; Source: "00000000-00004212.00000000.165716.079D2000.00000002.mdmp")3c:T1ad9,"SYSTEM\CurrentControlSet\Services\" in Source: 8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin "SOFTWARE\Microsoft\Cryptography" in Source: 8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin "uSoftware\Policies\Microsoft\Windows\Installer" in Source: 8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00004212.00000000.165716.00FDD000.00000004.mdmp 00000000-00004212.00000001.165742.00FDD000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004212.00000000.165716.03530000.00000004.mdmp 00000000-00004212.00000001.165742.03530000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004212.00000000.165716.05620000.00000004.mdmp 00000000-00004212.00000001.165742.05620000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004212.00000000.165716.07A10000.00000004.mdmp 00000000-00004212.00000001.165742.07A10000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004212.00000000.165716.07A10000.00000004.mdmp 00000000-00004212.00000001.165742.07A10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00004212.00000001.165742.05620000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramd" in Source: 00000000-00004212.00000001.165742.05620000.00000004.mdmp3d:T701,Process http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004212.00000001.165742.07E20000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004212.00000001.165742.07E20000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0+" - Source: "00000000-00004212.00000001.165742.07E20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftroo:ctxcg" - Source: "00000000-00004212.00000001.165742.07E20000.00000004.mdmp")55:T6c8,Found string "k__BackingField" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "k__BackingField" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "get_ScreenshotContentHash" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "set_ScreenshotContentHash" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "get_CurrentScreenshotContentHash" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "set_CurrentScreenshotContentHash" (Indicator: "nthash"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "k__BackingField" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "k__BackingField" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_ScreenshotContentHash" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_ScreenshotContentHash" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "get_CurrentScreenshotContentHash" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "set_CurrentScreenshotContentHash" (Indicator: "nthash"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp")56:T9e4,"__ConvertFromBase64StringFlexible" (Indicator: "base64"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "<1>__ConvertFromBase64StringFlexible" (Indicator: "FromBase64String"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "ZipFile" (Indicator: "zipfile"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "ParseBase32String" (Indicator: "base32"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "base32String" (Indicator: "base32"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "FromBase64String" (Indicator: "base64"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "<0>__ToBase64String" (Indicator: "base64"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "<0>__ToBase64String" (Indicator: "ToBase64String"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "base64String" (Indicator: "base64"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "ConvertToBase64UrlString" (Indicator: "base64"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string "nced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp")58:T85a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07B02000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp")59:T634,Found string "password" (Indicator: "password"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "secretBytes" (Indicator: "secret"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.05620000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "secretBytes" (Indicator: "secret"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp") Found string "secretKey" (Indicator: "secret"; Source: "00000000-00004212.00000000.165716.07B02000.00000002.mdmp")5a:T4aa,Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003908.00000000.166078.02EF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004212.00000000.165716.03530000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004212.00000001.165742.03530000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007336.00000000.165329.02830000.00000004.mdmp")5b:T6da,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; File: "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "TerminateProcesses" (Indicator: "TerminateProcess"; Source: "00000000-00004212.00000000.165716.079C2000.00000002.mdmp, 00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "TryTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004212.00000000.165716.079C2000.00000002.mdmp") Found reference to API "ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp") Found reference to API "rCorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004212.00000000.165716.729DF000.00000002.mdmp")5c:T9de,"__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"<1>__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"ScreenConnect.WindowsInstaller.dll\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp, 00000000-00004212.00000001.165742.05620000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004212.00000001.165742.03530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004536-00000C2B-1510620900\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFileSystemEntries\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFiles\" in \"ScreenConnect.InstallerActions.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004536-00000C2B-1510620900\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WindowsNative.WTSEnumerateSessions(IntPtr.Zero, 0, 1, &sessionInfos, &count)\" (Indicator: \"WTSEnumerateSessions\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004536-00000C2B-1501797464\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004536-00000C2B-1501797978\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004212-00000C2B-1522698798\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\"\n Found system information discovery API: \"WindowsNative.GetMonitorInfo(monitorHandle, ref monitorInfo)\" in file \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"CommandSendMessage\" (Indicator: \"sendmessage\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00004536-00000C2B-1510586913\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00004536-00000C2B-1510586942\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp\")\n Found reference to API \"HasSendMessageCapability\" (Indicator: \"sendmessage\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"WinExec\"; Source: \"00000000-00003908.00000000.166078.02EF0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00004212.00000000.165716.03530000.00000004.mdmp, 00000000-00004212.00000001.165742.03530000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00007336.00000000.165329.02830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadRunContext\" (Indicator: \"CreateThread\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"Microsoft.Deployment.Compression.dll\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"Microsoft.Deployment.Compression.dll\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$40","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$41","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"k__BackingField\" (Source: \"00000000-00004212.00000000.165716.07A32000.00000002.mdmp\")\n Found string \"get_Attachments\" (Source: \"00000000-00004212.00000000.165716.07A32000.00000002.mdmp\")\n Found string \"set_Attachments\" (Source: \"00000000-00004212.00000000.165716.07A32000.00000002.mdmp\")\n Found string \"JavaApplicationConfigurationSettingsAttachmentName\" (Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp, 00000000-00004212.00000000.165716.079D2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryEx\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004212.00000000.165716.079D2000.00000002.mdmp, 00000000-00004212.00000000.165716.07A32000.00000002.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004212.00000000.165716.07B02000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004212.00000000.165716.03530000.00000004.mdmp\n 00000000-00004212.00000001.165742.03530000.00000004.mdmp\"), Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp\n 00000000-00004212.00000001.165742.05620000.00000004.mdmp\"), Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004212.00000000.165716.05620000.00000004.mdmp\n 00000000-00004212.00000001.165742.05620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00004212.00000000.165716.00139000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00004212.00000000.165716.729DF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft Corporation\"\n \"ScreenConnect.Windows.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Microsoft.Deployment.WindowsInstaller.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.Cab.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"ScreenConnect.InstallerActions.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"instanceId=qye8vn&instanceFingerprint=23d3e0c6e2568e9c&filePath=C%3a%5c8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1.bin.exe&sessionId=8d296c21-7f2b-40c4-b641-cbb4c550e2ac&host=&referrer=&zone=0&productVersion=26.3.11.9650\" HTTP/1.1 200 OK\nDate: Fri\n 12 Jun 2026 12:15:47 GMT\nContent-Length: 0\nConnection: keep-alive\nCache-Control: private\nServer: Microsoft-IIS/10.0\nX-AspNet-Version: 4.0.30319\nX-Powered-By: ASP.NET with no response body","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a2bf83ec5a738f52303abbc"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"