26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious ABTrojan.GRIP Sample 911fc84b673d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 911fc84b673d…. Malware family: ABTrojan.GRIP. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9","keywords":["Malicious","ABTrojan.GRIP","malware analysis","sandbox report","threat intelligence","911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9"],"about":{"@type":"SoftwareApplication","name":"Anoma-dApp-installer_v1.31.5.msi","applicationCategory":["msi","data"],"identifier":"911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"ABTrojan.GRIP","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1eea,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemoryEx" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadStateChange" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtMapViewOfSectionEx" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemoryEx" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")28:T500,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")29:T7dd,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadStateChange" (Indicator: "NtCreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")2a:T1f09,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WaitForSingleObject returned an error code while attempting to print." (Indicator: "WaitForSingleObject"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop" (Indicator: "WaitForSingleObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")2b:Tc3d,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")2c:T8b2,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")2d:Tbb1,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")2e:T50e,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")2f:T5af,file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to "TPM 2.0: The authorization HMAC check failed and DA counter incremented." (Indicator: "HMAC"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to "TPM 2.0: TPM_RC_HMAC." (Indicator: "HMAC"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to "a.7:_x S n_c E h_u_b6=D_W# Y h_V tA lmxOid_H_qS.9{.7 G}:_tv_d_F%N.N R5" (Indicator: "Oid"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp")30:T123b,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-23-002E8AF8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-23-002E8AF8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-115-002F2BA1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-213-002E3700 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-213-002E3700 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-233-002E2E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-233-002E2E00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-240-002E7E90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-240-002E7E90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-250-002F1DD3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-250-002F1DD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-251-002F3540 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-251-002F3540 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-268-002E8110 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-268-002E8110 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-271-002E7D70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-271-002E7D70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-349-002E8020 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-349-002E8020 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-364-002E5DE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-364-002E5DE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-365-002E5A50 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-365-002E5A50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-379-002E5B20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-379-002E5B20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-392-002F143D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-392-002F143D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-393-002F3190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-393-002F3190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-395-002F3147 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-395-002F3147 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-430-002E3C80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-430-002E3C80 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-433-002E3B50 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-433-002E3B50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-434-002E3D00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-434-002E3D00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-435-002E3BD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-435-002E3BD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-444-002E3A20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-444-002E3A20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-445-002E35E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-445-002E35E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-447-002E3480 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-447-002E3480 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00005380-238-452-002E3130 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-452-002E3130 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005380-238-452-002E3130 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005380-238-470-002E18C031:T414,Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "Anoma-dApp-installer_v1.31.5.msi")32:T49a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples Matched sigs: YARA signature match – cryptographic algorithms33:T130c6,Found XOR loop in file "installer.exe" at offset 425159; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 499442; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 525734; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 525747; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 543175; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 573317; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 605712; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 643158; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 680810; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 701228; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 719156; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 787591; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 994638; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1022325; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1140004; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1193078; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1784861; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 1873003; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2523929; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2557265; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 2901616; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3043925; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3589337; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 3849576; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4228565; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4346945; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4353144; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 4748767; code bytes = 30d0 Found XOR loop in file "installer.exe" at offset 43504; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 448607; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 850387; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 852498; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 958179; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 986487; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1152617; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1188953; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1341806; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1397337; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1447844; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1494754; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1506538; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1525420; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1600368; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1692950; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1787508; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1817413; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1962135; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 1978424; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2112860; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2123700; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2187133; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2193303; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2271892; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2275096; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2281544; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2293361; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2319503; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2391084; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2442583; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2544307; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2557533; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2656873; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2665282; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2760570; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2792788; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2828089; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2895070; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 2967424; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3024952; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3099040; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3119485; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3133458; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3175378; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3206335; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3305339; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3336771; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3378862; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3411596; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3458632; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3488014; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3618251; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3698177; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3708858; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3712457; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3775054; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3789583; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3852333; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3914875; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 3953238; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4026656; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4110000; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4112391; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4155354; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4168545; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4183950; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4255397; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4309543; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4324487; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4413630; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4477308; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4588422; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4655869; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4683778; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4725317; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4744090; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4760830; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4962379; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 4988817; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5006446; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5032242; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5037763; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5037965; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5094099; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 5207286; code bytes = 33c1 Found XOR loop in file "installer.exe" at offset 675179; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 939186; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 966462; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 982837; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1083035; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1147761; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1151260; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1153473; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1256062; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1315082; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1316321; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1385982; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1461723; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1515899; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1556743; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1570502; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1618528; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1628395; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1701913; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1809542; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1810533; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1863298; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1871498; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1880286; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 1919289; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2002740; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2175289; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2209501; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2226036; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2272285; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2278844; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2308942; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2361196; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2554925; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2620374; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2631614; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2668019; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2723264; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2734613; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2829934; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2931434; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 2947023; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3023698; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3025320; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3029820; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3092695; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3177182; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3257331; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3303972; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3441670; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3547005; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3723017; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3727115; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3764808; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3767082; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3768467; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3901963; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3935207; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3957336; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 3976045; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4016741; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4031572; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4039694; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4065632; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4097196; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4101735; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4104064; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4152656; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4238654; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4270993; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4279132; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4300995; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4316046; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4331563; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4408033; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4491724; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4554739; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4569757; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4605055; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4634724; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4652501; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4662517; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4688979; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4690295; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4762441; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4765677; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4783657; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4800500; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4846560; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4907860; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4922880; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4933929; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4942224; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 4943013; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5016191; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5107775; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5136620; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5146642; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5239088; code bytes = 8030 Found XOR loop in file "installer.exe" at offset 5242257; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 99348; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 926580; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 1811503; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 2378575; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 2587747; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 2799481; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 2840634; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 2902689; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 3082247; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 3125092; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 3138627; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 3229413; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 3913296; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4089096; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4125488; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4144408; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4162752; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4303188; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4345928; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 4397184; code bytes = 30d0 Found XOR loop in file "python39.dll" at offset 265758; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 300422; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 304651; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 311668; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 330645; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 334901; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 451446; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 451612; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 452422; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 459484; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 467487; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 471466; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 480584; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 480975; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 480982; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 480989; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 480996; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 539977; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 551719; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 562689; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 574847; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 610993; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 654729; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 655974; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 656098; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 656275; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 687970; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 688081; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 688113; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 688468; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 688568; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 690296; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 693338; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 694207; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 695576; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 695613; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 742020; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 775597; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 934350; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 934904; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 934940; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 935111; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 935262; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 990898; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1116865; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117218; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117336; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117381; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117459; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117506; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117769; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117838; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117912; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1117989; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118046; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118107; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118417; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118500; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118580; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118597; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118709; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1118947; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119025; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119173; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119230; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119291; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119603; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119680; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119756; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1119855; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120171; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120279; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120335; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120406; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120471; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120779; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120855; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1120930; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121008; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121068; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121345; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121429; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121536; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121583; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121644; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1121952; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122059; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122136; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122183; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122239; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122536; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1122770; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1126089; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1126195; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1126341; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1126467; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1126768; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1127014; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1127933; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1128077; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1128190; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1128533; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1128792; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1129709; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1129847; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1129991; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1130303; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1130527; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1131450; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1131601; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1131741; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1132065; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1132316; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1133208; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1133361; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1133498; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1133816; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1134053; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1134959; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1135106; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1135255; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1135597; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1135792; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1136729; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1136877; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1137011; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1137307; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1137576; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1138478; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1138629; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1138769; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1139081; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1139337; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1140257; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1140398; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1140551; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1140883; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1141097; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1142000; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1142134; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1142299; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1142606; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1142843; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1143776; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1143921; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1144058; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1144373; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1144629; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1145339; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1145497; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1145659; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1145781; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1146004; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1146125; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1146584; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1146620; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1146765; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149214; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149527; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149609; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149687; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149739; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1149791; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150130; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150232; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150282; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150392; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150728; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150845; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150891; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1150981; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151031; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151370; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151450; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151527; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151607; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1151975; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152077; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152172; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152229; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152288; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152615; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152686; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152772; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152852; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1152904; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153222; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153394; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153469; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153528; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153850; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1153944; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154021; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154089; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154142; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154452; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154712; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1154761; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155100; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155189; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155266; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155337; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155389; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155709; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155902; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1155955; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1156017; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1156612; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1165119; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1165288; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1165723; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1165975; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1166918; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167058; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167224; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167567; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167796; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167901; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1167988; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1168724; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1168868; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1169012; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1169344; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1169608; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1170538; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1170679; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1170808; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1171147; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1171425; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1171500; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1171611; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1172350; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1172490; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1172639; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1172957; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1173193; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1174149; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1174297; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1174450; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1174824; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1175034; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1175932; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1176094; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1176232; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1176577; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1176834; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1177774; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1177911; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1178077; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1178437; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1178639; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1179591; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1179742; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1179880; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1180182; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1180480; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1181411; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1181548; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1181701; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1182028; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1182289; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1183217; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1183357; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1183511; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1183856; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1184097; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1185032; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1185148; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1185312; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1185823; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1185924; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186059; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186130; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186235; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186370; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186422; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186483; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1186521; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1276240; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312189; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312227; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312234; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312251; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312263; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312311; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312353; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312399; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312481; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312505; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312519; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312541; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312574; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312644; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312650; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312681; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312738; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312782; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312798; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312825; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312837; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312883; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312913; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1312981; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1313093; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1313579; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1313665; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1313708; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1313865; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1461412; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1524650; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1524784; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1533234; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1754814; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1938014; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1938180; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1938621; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1938882; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1939818; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1939946; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1940121; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1940449; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1940691; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1941624; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1941776; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1941919; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1942199; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1942510; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1942606; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1942691; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1943439; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1943583; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1943708; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1944048; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1944326; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1945255; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1945399; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1945549; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1945878; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1946116; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1947066; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1947208; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1947338; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1947857; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1947949; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948092; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948161; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948266; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948396; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948448; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948480; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1948552; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1955115; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 1967143; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2129041; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2131736; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2171765; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2236930; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2236986; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 2830542; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 3118402; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 3137949; code bytes = 33c1 Found XOR loop in file "python39.dll" at offset 449734; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 532986; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 628339; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 1104824; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 1187498; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 1980604; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2375576; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2567167; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2587614; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2594811; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2799280; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2893249; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 2902556; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 3024107; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 3138494; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 3229280; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 3478145; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 3636730; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 4176792; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 4452604; code bytes = 8030 Found XOR loop in file "python39.dll" at offset 4455463; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 200356; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 339044; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 1061921; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 1983325; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2093620; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2401576; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2506248; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2506536; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 2528469; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 3248748; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 3265072; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 23145; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149294; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149349; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149404; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149459; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149514; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149569; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149624; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 149673; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174492; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174696; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 174900; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175404; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175608; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 175812; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 176292; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 176512; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 177236; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 187992; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 191523; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 193531; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 196601; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 213053; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 454560; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 509833; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 510056; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 510283; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511252; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511415; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511571; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 511727; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 512655; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 512832; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 513010; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 513887; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514153; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514419; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 514594; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649276; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649279; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649402; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649529; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649564; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649660; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649791; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649826; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 649922; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650055; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650099; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650200; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650256; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650357; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650413; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650755; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650758; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650787; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650903; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650938; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 650954; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651054; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651099; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651199; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651354; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651527; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651583; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 651721; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 655991; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 659534; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 659801; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661741; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661834; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661861; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 661900; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 663068; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 872492; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 872526; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 872552; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 872574; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 872596; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 873870; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 874275; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875024; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 875779; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 876525; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 877331; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 878118; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 878930; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 879724; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 880539; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 881338; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882056; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882241; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882343; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 882418; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 885447; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 885479; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 886998; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 887325; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 887928; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 888530; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889128; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 889720; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890325; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 890918; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 891525; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892133; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 892810; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 946403; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 946438; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 948852; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1008376; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1130329; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1132163; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1132207; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1132256; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1132610; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1134690; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1134836; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1138610; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1140619; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1140761; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1144201; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151146; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151150; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151166; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151172; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151189; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1151198; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1154955; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1157250; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1157281; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1157318; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1157345; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1157360; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161305; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1161554; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1223606; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1223863; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1223938; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1226279; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1226304; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1266712; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1401926; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1402028; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1403313; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1521439; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1521471; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1522614; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1529231; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1529263; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1530450; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1615645; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1615669; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1615860; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1616959; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1617012; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1617021; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1617135; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1617194; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1667812; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1668827; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1668847; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1668867; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1694420; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1694529; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1694555; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1702986; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1703027; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1703247; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1713439; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1713460; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879158; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879278; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879329; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879452; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879497; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879611; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879661; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879821; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1879985; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880143; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880233; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880273; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880397; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880436; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880561; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880599; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880728; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1880890; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881066; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881389; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881557; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881727; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881883; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1881923; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882049; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882087; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882211; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882251; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882459; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882622; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882782; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882898; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1882951; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1883070; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1916754; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1917839; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1917903; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1928511; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1928575; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1944077; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1944142; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1944975; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1945039; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1947589; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1952148; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1986716; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1990673; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1992229; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1992876; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1993037; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1993088; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 1994365; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2000164; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2000297; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2000305; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2000313; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2000316; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2124352; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2349202; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2349364; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2455051; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2530140; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 2571248; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 200476; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 254699; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 310378; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2840242; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2841649; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 2842288; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3074888; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097061; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097065; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097069; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097073; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097077; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097081; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097085; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097089; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097093; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097097; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097101; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097105; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3097109; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3394300; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 3397159; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 688550; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 56771; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 56883; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 61456; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 67754; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 73859; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 73939; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 260056; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 330770; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 446434; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 446596; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 59948; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 326621; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 335920; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 351526; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 513880; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 638208; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 642996; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 684284; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 687143; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 688395; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 28542; code bytes = 30d0 Found XOR loop in file "Chime.exe" at offset 45832; code bytes = 30d0 Found XOR loop in file "Chime.exe" at offset 317614; code bytes = 30d0 Found XOR loop in file "Chime.exe" at offset 615529; code bytes = 30d0 Found XOR loop in file "Chime.exe" at offset 616735; code bytes = 30d0 Found XOR loop in file "Chime.exe" at offset 34000; code bytes = 33c1 Found XOR loop in file "Chime.exe" at offset 34481; code bytes = 33c1 Found XOR loop in file "Chime.exe" at offset 34610; code bytes = 33c1 Found XOR loop in file "Chime.exe" at offset 172304; code bytes = 33c1 Found XOR loop in file "Chime.exe" at offset 610597; code bytes = 33c1 Found XOR loop in file "Chime.exe" at offset 137576; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 149900; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 162250; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 608412; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 626961; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 629556; code bytes = 8030 Found XOR loop in file "Chime.exe" at offset 629803; code bytes = 8030 Found XOR loop in file "VAgent.exe" at offset 28585; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 28606; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 28627; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 28696; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 28788; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 28887; code bytes = 33c1 Found XOR loop in file "VAgent.exe" at offset 2731; code bytes = 8030 Found XOR loop in file "VAgent.exe" at offset 123252; code bytes = 8030 Found XOR loop in file "VAgent.exe" at offset 124607; code bytes = 8030 Found XOR loop in file "VAgent.exe" at offset 128940; code bytes = 8030 Found XOR loop in file "VAgent.exe" at offset 132430; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 60112; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 252276; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 388740; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 448244; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 795186; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 795390; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 795526; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 795683; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 796116; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 796560; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 796704; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 806593; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 806705; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8666; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 8800; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 426757; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 155672; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 451972; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 656000; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1114876; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 1117735; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 129594; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 129728; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 44050; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 212139; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 265468; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 268327; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 1813; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2356; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2646; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2697; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2753; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 2881; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 10318; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 16592; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 18510; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55102; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55113; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 55281; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56028; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56035; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56090; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 56364; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57257; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57270; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57940; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 57950; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 76602; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 76736; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 97341; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 81805; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 156412; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 159271; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 9034; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 9168; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 33995; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 126688; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 148220; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 151079; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 22282; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 22416; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 120060; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 122919; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 7953; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 11492; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 39946; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 40080; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 80124; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 82983; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 8426; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 8560; code bytes = 33c1 Found XOR loop in file "_socket.pyd" at offset 73980; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 76839; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 15258; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 15392; code bytes = 33c1 Found XOR loop in file "_hashlib.pyd" at offset 59644; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 62503; code bytes = 8030 Found XOR loop in file "select.pyd" at offset 3674; code bytes = 33c1 Found XOR loop in file "select.pyd" at offset 3808; code bytes = 33c1 Found XOR loop in file "select.pyd" at offset 22268; code bytes = 8030 Found XOR loop in file "select.pyd" at offset 25127; code bytes = 803034:T536,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")35:T468,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Anoma-dApp-installer_v1.31.5.msi") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Chime.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "VAgent.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp")36:T660,Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSidEx" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")37:T14a5,Found system information discovery API: "GetEnvironmentStrings" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "GetEnvironmentStringsW" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "GetNativeSystemInfo" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "GetUserObjectInformationW" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "GetSystemInfo" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "GetUserObjectInformationA" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "ExpandEnvironmentStringsA" in file "Anoma-dApp-installer_v1.31.5.msi" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "NtWow64GetNativeSystemInformation" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "ZwWow64GetNativeSystemInformation" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005380.00000002.237946.722F6000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00005380.00000002.237946.722F6000.00000002.mdmp"38:T492,Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WMRSendMessageString" (Indicator: "sendmessage"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp")39:T45e,"ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005808) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006132) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00008180) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006940) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007804) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00009016) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00008488) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006872) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003776) "ISBEW64.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003608) "installer.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00008268) "installer.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005228)3a:T2c61,"ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005808) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006132) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008180) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006940) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007804) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009016) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008488) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006872) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003776) "ISBEW64.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003608) "installer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008268) "installer.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008268) "installer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005228) "installer.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000020164cf937020000ffffffffffffffffe01a2cfb3702000066a094c9fe7f000008000000000000000000000000000000ffffffffffffffffe06f1ebaab000000e1f378c9fe7f0000080000000000000030ec0ffb3702000068a094c9fe7f00007f000000000000004800000000000000000000000000000058000000000000003c0979c9fe7f0000e06f1ebaab00000044ec9d97442500005002afc9fe7f000040e75df9370200005002afc9fe7f000040e75df9370200005002afc9fe7f000069a094c9fe7f000000000000000000001fed78c9fe7f000090701ebaab000000b0f215fb3702000040e75df93702000050da7efb3702000000000000 (UID: 00000000-00005228) "installer.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000002598fb370200000000000000000000a06899fb3702000066a094c9fe7f000008000000000000000000000000000000ffffffffffffffff108a1ebaab000000e1f378c9fe7f0000080000000000000030ec0ffb3702000068a094c9fe7f00007f000000000000004800000000000000000000000000000062000000000000003c0979c9fe7f0000108a1ebaab000000140a9d97442500005002afc9fe7f000040e75df9370200005002afc9fe7f000040e75df9370200005002afc9fe7f000069a094c9fe7f000000000000000000001fed78c9fe7f0000c08a1ebaab00000070a382fb3702000040e75df937020000002598fb3702000000000000 (UID: 00000000-00005228) "VAgent.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004644) "Chime.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000078f0cf00e8103177000000000800000048eecf000000000000000000000000000000000000000000000000000000000000000000000000001800000069b06d8269006e00f0e7cf006f00720074efcf0050189e7245a73df0feffffff3276aae44054f80058efcf000000c6754054f800f000c675000000008ceecf000000000088efcf00b0e83877caa82793feffffffeceecf00c0193677010000000000c67500000000000000004054f80000000000b014f700f000c6750000000198efcf00f20d3577090000004cefcf0058efcf006a77aae44054f80000000000b014f7008454f800000000000200000000000000acefcf000000000001000000 (UID: 00000000-00002112) "Chime.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002112)3b:T4cc,"VAgent.exe" called "OpenMutexW" with parameter "Global\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\1\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\2\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\3\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\4\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\5\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\6\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\7\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644) "VAgent.exe" called "OpenMutexW" with parameter "Session\8\MSCTF.Asm.{5d99b4d8-5a08-9316-31bc-c9d86449b20e}" - (UID: 00000000-00004644)3c:Ta72,Found string "Select * FROM ISSetupFile" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `Control` WHERE `Type` = 'ScrollableText' AND `Dialog_` = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `%s`" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `%s` WHERE Shortcut = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM ISSetupType ORDER BY Display" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM ISFeatureExtended WHERE Feature_ = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM Feature WHERE Feature_Parent = '%s' ORDER By Display" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM ISRequiredFeature WHERE RequiringFeature = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM Directory WHERE Directory = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `Binary` WHERE `Name`= '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `CustomAction` WHERE `Action` = '%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `Directory`" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `Component` WHERE `Directory_`='%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `Directory` WHERE `Directory`='%s'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM _Property" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM InstallUISequence ORDER By Sequence" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM AdminUISequence ORDER By Sequence" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM AdvtUISequence ORDER By Sequence" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM `InstallUISequence` WHERE `Action`='ISSetupFilesExtract'" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "SELECT * FROM Upgrade" (Indicator: "select * from "; File: "Anoma-dApp-installer_v1.31.5.msi")3d:T5a2,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "RtlGetSystemTimeAndBias" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")3e:T4b7,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")3f:T5a2,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "RtlGetSystemTimeAndBias" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")40:T6af,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")41:T11e2,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetVersionEx" (Indicator: "GetVersion"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")42:Tf08,"installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672537193 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672538079 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672540782 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672541835 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672542929 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672545224 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672549131 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672550098 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672551305 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672552637 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672553680 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672554896 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672555940 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672557518 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672558569 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672560363 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672561407 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672562475 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672563569 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672567370 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672569727 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672571221 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672572526 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-2672573806 "installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" at 00000000-00005228-00000C17-267257559243:T1c4e,"ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005808) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005808) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005808) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005808) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006132) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006132) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006132) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006132) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008180) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008180) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008180) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008180) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006940) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006940) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006940) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006940) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007804) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007804) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007804) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007804) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009016) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009016) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009016) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009016) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008488) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008488) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008488) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008488) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006872) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006872) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006872) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006872) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003776) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003776) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003776) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003776) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003608) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003608) "ISBEW64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003608) "ISBEW64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003608) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008268) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008268) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008268) "installer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008268) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008268) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI82682\python39.dll (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI82682\python3 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter python3 (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI82682\_ctypes.pyd (UID: 00000000-00005228) "installer.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005228) "VAgent.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004644) "VAgent.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004644) "Chime.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002112) "Chime.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002112)44:T13e99,"ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005808) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006132) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00008180) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006940) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007804) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00009016) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00008488) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006872) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003776) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003608) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003608) "installer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00008268) "installer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_DontWriteBytecodeFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_FileSystemDefaultEncoding (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_FrozenFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_IgnoreEnvironmentFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_NoSiteFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_NoUserSiteDirectory (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_OptimizeFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_VerboseFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_UnbufferedStdioFlag (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_UTF8Mode (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_BuildValue (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_DecRef (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_Finalize (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_IncRef (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_Initialize (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_SetPath (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_GetPath (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_SetProgramName (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_SetPythonHome (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyDict_GetItemString (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_Clear (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_Occurred (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_Print (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_Fetch (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_Restore (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyErr_NormalizeException (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyImport_AddModule (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyImport_ExecCodeModule (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyImport_ImportModule (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyList_Append (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyList_New (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyLong_AsLong (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyModule_GetDict (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyObject_CallFunction (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyObject_CallFunctionObjArgs (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyObject_SetAttrString (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyObject_GetAttrString (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyObject_Str (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyRun_SimpleStringFlags (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PySys_AddWarnOption (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PySys_SetArgvEx (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PySys_GetObject (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PySys_SetObject (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PySys_SetPath (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyEval_EvalCode (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyMarshal_ReadObjectFromString (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_FromString (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter Py_DecodeLocale (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyMem_RawFree (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_FromFormat (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_Decode (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_DecodeFSDefault (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_AsUTF8 (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_Join (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyUnicode_Replace (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter PyInit__ctypes (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005228) "installer.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005228) "VAgent.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter ZwOpenDirectoryObject (UID: 00000000-00004644) "VAgent.exe" called "GetProcAddress" with a parameter ZwQueryDirectoryObject (UID: 00000000-00004644) "Chime.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002112) "Chime.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002112)45:Tf98,"Select * FROM ISSetupFile" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from issetupfile") "SELECT * FROM `Control` WHERE `Type` = 'ScrollableText' AND `Dialog_` = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `control` where `type` = 'scrollabletext' and `dialog_` = '%s'") "SELECT * FROM `%s`" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `%s`") "SELECT * FROM `%s` WHERE Shortcut = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `%s` where shortcut = '%s'") "SELECT Component FROM Component" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component from component") "SELECT Component_,FileSize FROM File" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,filesize from file") "SELECT Component_,ReserveFolder,ReserveLocal,ReserveSource FROM ReserveCost" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,reservefolder,reservelocal,reservesource from reservecost") "SELECT Component_,File_,DestFolder FROM DuplicateFile" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,file_,destfolder from duplicatefile") "SELECT FileSize FROM File WHERE File = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select filesize from file where file = '%s'") "SELECT Directory FROM Directory" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select directory from directory") "SELECT * FROM ISSetupType ORDER BY Display" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from issetuptype order by display") "SELECT * FROM ISFeatureExtended WHERE Feature_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from isfeatureextended where feature_ = '%s'") "SELECT Component_ FROM FeatureComponents WHERE Feature_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_ from featurecomponents where feature_ = '%s'") "SELECT Directory_ FROM Component WHERE Component = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select directory_ from component where component = '%s'") "SELECT * FROM Feature WHERE Feature_Parent = '%s' ORDER By Display" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from feature where feature_parent = '%s' order by display") "SELECT Feature, Attributes FROM Feature WHERE `Feature_Parent` = ''" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select feature, attributes from feature where `feature_parent` = ''") "SELECT * FROM ISRequiredFeature WHERE RequiringFeature = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from isrequiredfeature where requiringfeature = '%s'") "SELECT Feature_ FROM ISSetupTypeFeatures WHERE ISSetupType_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select feature_ from issetuptypefeatures where issetuptype_ = '%s'") "SELECT * FROM Directory WHERE Directory = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from directory where directory = '%s'") "SELECT * FROM `Binary` WHERE `Name`= '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `binary` where `name`= '%s'") "SELECT `Value` FROM `Property` WHERE `Property` = 'ProductCode'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select `value` from `property` where `property` = 'productcode'") "SELECT * FROM `CustomAction` WHERE `Action` = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `customaction` where `action` = '%s'") "SELECT * FROM `Directory`" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `directory`") "SELECT * FROM `Component` WHERE `Directory_`='%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `component` where `directory_`='%s'") "SELECT * FROM `Directory` WHERE `Directory`='%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `directory` where `directory`='%s'")46:T12b2,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "odCreateProcess64" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found reference to API "odCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateProcessStateChange" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersWithTemplate" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateProcessStateChange" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")47:T6fb,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "PlaiCreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")48:T639,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")49:Tef9,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")4a:Teff,Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")4b:T4d2,Found reference to API "NtOpenEvent" (Indicator: "NtOpenEvent"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenEventPair" (Indicator: "NtOpenEvent"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenEvent" (Indicator: "ZwOpenEvent"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenEventPair" (Indicator: "ZwOpenEvent"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")4c:T1ac3,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtCreateThreadStateChange" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwCreateThreadStateChange" (Indicator: "CreateThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")4d:Tc25,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")4e:T4a7,file/memory contains long string with (Indicator: "GetLastError"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "ReturnValue=%ldGetLastError=0x%08lx" (Indicator: "GetLastError"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")4f:T4782,"Software\Classes" in Source: Anoma-dApp-installer_v1.31.5.msi "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: Anoma-dApp-installer_v1.31.5.msi "HARDWARE\DESCRIPTION\System" in Source: Anoma-dApp-installer_v1.31.5.msi "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion" in Source: Anoma-dApp-installer_v1.31.5.msi "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: Anoma-dApp-installer_v1.31.5.msi "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\InetStp" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\InstallShield\ISWI\3.0\SetupExeLog" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\InstallShield\ISWI\7.0\SetupExeLog" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Installer\Products\%s" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_%s" in Source: Anoma-dApp-installer_v1.31.5.msi "SOFTWARE\InstallShield\ISEngine26.0" in Source: Anoma-dApp-installer_v1.31.5.msi "Software\InstallShieldPendingOperation" in Source: Anoma-dApp-installer_v1.31.5.msi "System\CurrentControlSet\Services\PLA\Configuration" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\PLA" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysMonLog" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "SOFTWARE\CLASSES\CLSID\{9a5dd473-d410-11d1-b829-00c04f94c7c3}" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Control\WMI\AutoLogger" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog\Log Queries" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp 00000000-00005380.00000001.236929.00A90000.00000004.mdmp 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\CodePage" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\International" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp ":\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Files" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "HARDWARE\DESCRIPTION\System" in Source: 00000000-00005380.00000002.237946.002F5000.00000002.mdmp 00000000-00005380.00000002.237946.722F6000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000002.237946.002F5000.00000002.mdmp 00000000-00005380.00000002.237946.722F6000.00000002.mdmp50:T900,Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5808:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5808:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:5808:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:5808:120:WilError_03" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6132:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6132:120:WilError_03" Process ISBEW64.exe created mutex with name "SM0:6132:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:6132:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8180:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8180:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:8180:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:8180:120:WilError_03" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6940:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6940:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:6940:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:6940:120:WilError_03" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7804:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7804:120:WilError_03" Process ISBEW64.exe created mutex with name "SM0:7804:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:7804:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9016:120:WilError_03" Process ISBEW64.exe created mutex with name "SM0:9016:120:WilError_03" Process ISBEW64.exe created mutex with name "Local\SM0:9016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8488:304:WilStaging_02"51:T8d3,"python39.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Chime.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VAgent.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "select.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT52:T70f6,"System\CurrentControlSet\Services\PLA\Configuration" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Services\PLA" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysMonLog" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "SOFTWARE\CLASSES\CLSID\{9a5dd473-d410-11d1-b829-00c04f94c7c3}" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Control\WMI\AutoLogger" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog\Log Queries" in Source: 00000000-00005380.00000000.235011.00A90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\CodePage" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\International" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp ":\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Files" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\CodePage" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\International" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp ":\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Files" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\CodePage" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\International" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp ":\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Files" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp "System\CurrentControlSet\Services\PLA\Configuration" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Services\PLA" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysMonLog" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "SOFTWARE\CLASSES\CLSID\{9a5dd473-d410-11d1-b829-00c04f94c7c3}" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Control\WMI\AutoLogger" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog\Log Queries" in Source: 00000000-00005380.00000001.236929.00A90000.00000004.mdmp "HARDWARE\DESCRIPTION\System" in Source: 00000000-00005380.00000002.237946.002F5000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000002.237946.002F5000.00000002.mdmp "System\CurrentControlSet\Services\PLA\Configuration" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\PLA" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysMonLog" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "SOFTWARE\CLASSES\CLSID\{9a5dd473-d410-11d1-b829-00c04f94c7c3}" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Control\WMI\AutoLogger" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog\Log Queries" in Source: 00000000-00005380.00000002.237946.00A90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\CodePage" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\International" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "Software\Microsoft\LanguageOverlay" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp ":\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Files" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp "HARDWARE\DESCRIPTION\System" in Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp53:Td05,"ISBEW64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff09a30000 "ISBEW64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff09a30000 "ISBEW64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff09a30000 "ISBEW64.exe" loaded module "KERNEL32" at base 7fff0ad70000 "ISBEW64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff06d20000 "ISBEW64.exe" loaded module "KERNEL32.DLL" at base 7fff0ad70000 "ISBEW64.exe" loaded module "RPCRT4.DLL" at base 7fff0afa0000 "ISBEW64.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7fff0ba80000 "installer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff09a30000 "installer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff09a30000 "installer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff09a30000 "installer.exe" loaded module "KERNEL32" at base 7fff0ad70000 "installer.exe" loaded module "RPCRT4.DLL" at base 7fff0afa0000 "installer.exe" loaded module "NTDLL.DLL" at base 7fff0c2d0000 "installer.exe" loaded module "KERNELBASE" at base 7fff09a30000 "installer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fff08740000 "installer.exe" loaded module "%TEMP%\_MEI82682\PYTHON39.DLL" at base 7ffec9710000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff086b0000 "installer.exe" loaded module "KERNEL32.DLL" at base 7fff0ad70000 "installer.exe" loaded module "%TEMP%\_MEI82682\PYTHON3" at base 0 "installer.exe" loaded module "PYTHON3" at base 0 "installer.exe" loaded module "%TEMP%\_MEI82682\_CTYPES.PYD" at base 7ffee1660000 "installer.exe" loaded module "USER32" at base 7fff0ab30000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff06d20000 "installer.exe" loaded module "COMCTL32.DLL" at base 7ffef3910000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7fff0a2c0000 "installer.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fff0aef0000 "installer.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7fff0ab30000 "installer.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7fff0ab30000 "installer.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7fff0a210000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7fff0c010000 "VAgent.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76700000 "VAgent.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76700000 "VAgent.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76700000 "VAgent.exe" loaded module "KERNEL32" at base 75e60000 "VAgent.exe" loaded module "MSVCRT.DLL" at base 75d90000 "VAgent.exe" loaded module "RPCRT4.DLL" at base 76ab0000 "VAgent.exe" loaded module "USER32.DLL" at base 76260000 "Chime.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76700000 "Chime.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76700000 "Chime.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76700000 "Chime.exe" loaded module "KERNEL32" at base 75e60000 "Chime.exe" loaded module "MSVCRT.DLL" at base 75d90000 "Chime.exe" loaded module "RPCRT4.DLL" at base 76ab0000 "Chime.exe" loaded module "USER32.DLL" at base 7626000054:T92a,"Anoma-dApp-installer_v1.31.5.msi" was detected as "Microsoft Compound" and name: "Archive" "Anoma-dApp-installer_v1.31.5.msi" was detected as "Microsoft Compound" and name: "Data" "python39.dll" was detected as "Microsoft Compound" and name: "Archive" "python39.dll" was detected as "Microsoft Compound" and name: "Data" "libcrypto-1_1.dll" was detected as "Microsoft Compound" and name: "Archive" "libcrypto-1_1.dll" was detected as "Microsoft Compound" and name: "Data" "libssl-1_1.dll" was detected as "Microsoft Compound" and name: "Archive" "libssl-1_1.dll" was detected as "Microsoft Compound" and name: "Data" "Chime.exe" was detected as "Microsoft Compound" and name: "Archive" "Chime.exe" was detected as "Microsoft Compound" and name: "Data" "VAgent.exe" was detected as "Microsoft Compound" and name: "Archive" "VAgent.exe" was detected as "Microsoft Compound" and name: "Data" "VCRUNTIME140.dll" was detected as "Microsoft Compound" and name: "Archive" "VCRUNTIME140.dll" was detected as "Microsoft Compound" and name: "Data" "unicodedata.pyd" was detected as "Microsoft Compound" and name: "Archive" "unicodedata.pyd" was detected as "Microsoft Compound" and name: "Data" "_decimal.pyd" was detected as "Microsoft Compound" and name: "Archive" "_decimal.pyd" was detected as "Microsoft Compound" and name: "Data" "_lzma.pyd" was detected as "Microsoft Compound" and name: "Archive" "_lzma.pyd" was detected as "Microsoft Compound" and name: "Data" "_ssl.pyd" was detected as "Microsoft Compound" and name: "Archive" "_ssl.pyd" was detected as "Microsoft Compound" and name: "Data" "_ctypes.pyd" was detected as "Microsoft Compound" and name: "Archive" "_ctypes.pyd" was detected as "Microsoft Compound" and name: "Data" "_bz2.pyd" was detected as "Microsoft Compound" and name: "Archive" "_bz2.pyd" was detected as "Microsoft Compound" and name: "Data" "_socket.pyd" was detected as "Microsoft Compound" and name: "Archive" "_socket.pyd" was detected as "Microsoft Compound" and name: "Data" "_hashlib.pyd" was detected as "Microsoft Compound" and name: "Archive" "_hashlib.pyd" was detected as "Microsoft Compound" and name: "Data" "select.pyd" was detected as "Microsoft Compound" and name: "Archive" "select.pyd" was detected as "Microsoft Compound" and name: "Data"55:Tf98,"Select * FROM ISSetupFile" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from issetupfile") "SELECT * FROM `Control` WHERE `Type` = 'ScrollableText' AND `Dialog_` = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `control` where `type` = 'scrollabletext' and `dialog_` = '%s'") "SELECT * FROM `%s`" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `%s`") "SELECT * FROM `%s` WHERE Shortcut = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `%s` where shortcut = '%s'") "SELECT Component FROM Component" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component from component") "SELECT Component_,FileSize FROM File" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,filesize from file") "SELECT Component_,ReserveFolder,ReserveLocal,ReserveSource FROM ReserveCost" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,reservefolder,reservelocal,reservesource from reservecost") "SELECT Component_,File_,DestFolder FROM DuplicateFile" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_,file_,destfolder from duplicatefile") "SELECT FileSize FROM File WHERE File = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select filesize from file where file = '%s'") "SELECT Directory FROM Directory" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select directory from directory") "SELECT * FROM ISSetupType ORDER BY Display" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from issetuptype order by display") "SELECT * FROM ISFeatureExtended WHERE Feature_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from isfeatureextended where feature_ = '%s'") "SELECT Component_ FROM FeatureComponents WHERE Feature_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select component_ from featurecomponents where feature_ = '%s'") "SELECT Directory_ FROM Component WHERE Component = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select directory_ from component where component = '%s'") "SELECT * FROM Feature WHERE Feature_Parent = '%s' ORDER By Display" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from feature where feature_parent = '%s' order by display") "SELECT Feature, Attributes FROM Feature WHERE `Feature_Parent` = ''" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select feature, attributes from feature where `feature_parent` = ''") "SELECT * FROM ISRequiredFeature WHERE RequiringFeature = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from isrequiredfeature where requiringfeature = '%s'") "SELECT Feature_ FROM ISSetupTypeFeatures WHERE ISSetupType_ = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select feature_ from issetuptypefeatures where issetuptype_ = '%s'") "SELECT * FROM Directory WHERE Directory = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from directory where directory = '%s'") "SELECT * FROM `Binary` WHERE `Name`= '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `binary` where `name`= '%s'") "SELECT `Value` FROM `Property` WHERE `Property` = 'ProductCode'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select `value` from `property` where `property` = 'productcode'") "SELECT * FROM `CustomAction` WHERE `Action` = '%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `customaction` where `action` = '%s'") "SELECT * FROM `Directory`" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `directory`") "SELECT * FROM `Component` WHERE `Directory_`='%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `component` where `directory_`='%s'") "SELECT * FROM `Directory` WHERE `Directory`='%s'" (Source: Anoma-dApp-installer_v1.31.5.msi, Indicator: "select * from `directory` where `directory`='%s'")56:Ta25,Process "msiexec.exe" (UID: 00000000-00003872) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00003872) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, EFC_5620, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00005224) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-8LD9T6N", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", FPS_BROWSER_USER_PROFILE_STRING="Default", EFC_5620="1", HOMEPATH="\Users\7ekC0hN", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00005224) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP" Process "ISBEW64.exe" (UID: 00000000-00005808) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ISBEW64.exe" (UID: 00000000-00005808) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "BetaC32.exe" (UID: 00000000-00005380) was launched with new environment variables: "XDMEJDZQASFGNKMLAFCHHQTTT="xfnnpvogiowlf"" Process "installer.exe" (UID: 00000000-00008268) was launched with new environment variables: "CEYGVRAGONORGNOJFWIYC="%TEMP%\8A7F948.tmp"" Process "installer.exe" (UID: 00000000-00005228) was launched with new environment variables: "USERDNSDOMAIN="xjZvL7TVrD5ReKa", _MEIPASS2="%TEMP%\_MEI82682"" Process "installer.exe" (UID: 00000000-00005228) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "installer.exe" (UID: 00000000-00005228) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "VAgent.exe" (UID: 00000000-00004644) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", WZQHHRSVUZLXEDLETSXZDPAP="%TEMP%\93934FC.tmp"" Process "VAgent.exe" (UID: 00000000-00004644) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "VAgent.exe" (UID: 00000000-00004644) was launched with missing environment variables: "USERDNSDOMAIN, _MEIPASS2"57:T7b6,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00003872) Spawned process "MsiExec.exe" with commandline "-Embedding 11DD81761381146B80DA49CA5A69E601 C" (UID: 00000000-00005224) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6E3B061-8F58-4884-B71D- ..." (UID: 00000000-00005808) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AD797BB-1F5A-44EE-8ECC- ..." (UID: 00000000-00006132) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE504EF6-8665-40AE-A41D- ..." (UID: 00000000-00008180) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84887264-C02C-45BC-A248- ..." (UID: 00000000-00006940) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F9FF893-FFB5-4031-BBC2- ..." (UID: 00000000-00007804) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6C54818-63A3-4C70-81A0- ..." (UID: 00000000-00009016) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13CF953D-6C75-4997-AE08- ..." (UID: 00000000-00008488) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{388F2163-71B2-4DB3-8286- ..." (UID: 00000000-00006872) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4545DCED-F950-4716-B658- ..." (UID: 00000000-00003776) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{643C4BF7-F018-430D-88FB- ..." (UID: 00000000-00003608) Spawned process "BetaC32.exe" (UID: 00000000-00004668) Spawned process "BetaC32.exe" (UID: 00000000-00005380) Spawned process "installer.exe" (UID: 00000000-00008268) Spawned process "installer.exe" (UID: 00000000-00005228) Spawned process "VAgent.exe" (UID: 00000000-00004644) Spawned process "Chime.exe" (UID: 00000000-00002112)58:T7b6,Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00003872) Spawned process "MsiExec.exe" with commandline "-Embedding 11DD81761381146B80DA49CA5A69E601 C" (UID: 00000000-00005224) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6E3B061-8F58-4884-B71D- ..." (UID: 00000000-00005808) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AD797BB-1F5A-44EE-8ECC- ..." (UID: 00000000-00006132) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE504EF6-8665-40AE-A41D- ..." (UID: 00000000-00008180) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84887264-C02C-45BC-A248- ..." (UID: 00000000-00006940) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F9FF893-FFB5-4031-BBC2- ..." (UID: 00000000-00007804) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6C54818-63A3-4C70-81A0- ..." (UID: 00000000-00009016) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13CF953D-6C75-4997-AE08- ..." (UID: 00000000-00008488) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{388F2163-71B2-4DB3-8286- ..." (UID: 00000000-00006872) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4545DCED-F950-4716-B658- ..." (UID: 00000000-00003776) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{643C4BF7-F018-430D-88FB- ..." (UID: 00000000-00003608) Spawned process "BetaC32.exe" (UID: 00000000-00004668) Spawned process "BetaC32.exe" (UID: 00000000-00005380) Spawned process "installer.exe" (UID: 00000000-00008268) Spawned process "installer.exe" (UID: 00000000-00005228) Spawned process "VAgent.exe" (UID: 00000000-00004644) Spawned process "Chime.exe" (UID: 00000000-00002112)59:T62c,Found reference to API "LdrLoadDll" (Indicator: "LdrLoadDll"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetDllHandleEx" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetDllHandle" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetDllHandleByMapping" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetDllHandleByName" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")5a:T76a,Found reference to API "NtQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueueApcThreadEx2" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueueApcThreadEx2" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")5b:Tc2a,"installer.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%APPDATA%\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\installer.exe]- [targetUID: 00000000-00005228] "python39.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\python39.dll]- [targetUID: 00000000-00005228] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libcrypto-1_1.dll]- [targetUID: 00000000-00008268] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libssl-1_1.dll]- [targetUID: 00000000-00008268] "Chime.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\PMR_Make_beta\Chime.exe]- [targetUID: 00000000-00005380] "VAgent.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\VAgent.exe]- [targetUID: 00000000-00005380] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI82682\VCRUNTIME140.dll]- [targetUID: 00000000-00005228] "8A7F948.tmp" has type "data"- Location: [%TEMP%\8A7F948.tmp]- [targetUID: 00000000-00005380] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\unicodedata.pyd]- [targetUID: 00000000-00008268] "base_library.zip" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [%TEMP%\_MEI82682\base_library.zip]- [targetUID: 00000000-00005228] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_decimal.pyd]- [targetUID: 00000000-00008268] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_lzma.pyd]- [targetUID: 00000000-00008268] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ssl.pyd]- [targetUID: 00000000-00008268] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ctypes.pyd]- [targetUID: 00000000-00005228] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_bz2.pyd]- [targetUID: 00000000-00008268] "overlay_5ec25a95aa22c048ab8ada2ae8fe23cca9e262f9f6daae8956a3923849d91de5" has type "data"- [targetUID: N/A] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_socket.pyd]- [targetUID: 00000000-00008268] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_hashlib.pyd]- [targetUID: 00000000-00008268] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\select.pyd]- [targetUID: 00000000-00008268] "93934FC.tmp" has type "data"- Location: [%TEMP%\93934FC.tmp]- [targetUID: 00000000-00005380]5c:T681,"ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "") "ISBEW64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS"; Key: ""; Value: "")5d:T854,"python39.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\python39.dll]- [targetUID: 00000000-00005228] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libcrypto-1_1.dll]- [targetUID: 00000000-00008268] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libssl-1_1.dll]- [targetUID: 00000000-00008268] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI82682\VCRUNTIME140.dll]- [targetUID: 00000000-00005228] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\unicodedata.pyd]- [targetUID: 00000000-00008268] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_decimal.pyd]- [targetUID: 00000000-00008268] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_lzma.pyd]- [targetUID: 00000000-00008268] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ssl.pyd]- [targetUID: 00000000-00008268] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ctypes.pyd]- [targetUID: 00000000-00005228] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_bz2.pyd]- [targetUID: 00000000-00008268] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_socket.pyd]- [targetUID: 00000000-00008268] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_hashlib.pyd]- [targetUID: 00000000-00008268] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\select.pyd]- [targetUID: 00000000-00008268]5e:Tad4,"ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "ISBEW64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")5f:T4f3,"ISBEW64.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "ISBEW64.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\ISBEW64.exe" "ISBEW64.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "ISBEW64.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "ISBEW64.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "ISBEW64.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\win32u.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\user32.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\sechost.dll" "ISBEW64.exe" trying to touch file "C:\Windows\System32\advapi32.dll"60:T770,"installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\VCRUNTIME140.dll" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libcrypto-1_1.dll" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libffi-7.dll" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libssl-1_1.dll" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\python39.dll" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\ucrtbase.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\VERSION.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\CRYPTBASE.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\CRYPTBASE.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\python3.DLL" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\python3.DLL" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\TextShaping.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\TextShaping.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\imageres.dll" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\imageres.dll" "Chime.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\CRYPTSP.DLL"61:T99b,"installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_bz2.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ctypes.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_decimal.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_hashlib.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_lzma.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_socket.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ssl.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\select.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\unicodedata.pyd" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Local\Temp\_MEI82682\python39._pth" "installer.exe" trying to access non-existent file "C:\Users\7ekC0hN\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\installer._pth" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\pyvenv.cfg" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\pyvenv.cfg" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\lib-dynload" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\ctypes" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\win32" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\pythonwin" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\pywin32_system32" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\eggs" "installer.exe" trying to access non-existent file "C:\user32" "installer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\user32"62:T40f,"BetaC32.exe" writes file "c:\programdata\pmr_make_beta\betac32.exe" "BetaC32.exe" writes file "c:\programdata\pmr_make_beta\aliyunwrap.dll" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\roaming\pmr_make_beta\chime.exe" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\roaming\pmr_make_beta\angrbcayaexrvtslup\installer.exe" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\local\temp\8a7f948.tmp" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\local\temp\9041f02.tmp" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\local\vagent.exe" "BetaC32.exe" writes file "c:\users\%osuser%\appdata\local\temp\93934fc.tmp" "BetaC32.exe" writes file "%appdata%\pmr_make_beta\chime.exe" "BetaC32.exe" writes file "%appdata%\pmr_make_beta\angrbcayaexrvtslup\installer.exe" "BetaC32.exe" writes file "%temp%\8a7f948.tmp" "BetaC32.exe" writes file "%localappdata%\vagent.exe" "BetaC32.exe" writes file "%temp%\93934fc.tmp" "installer.exe" writes file "c:\users\%osuser%\appdata\local\temp\_mei82682\vcruntime140.dll"63:T422,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")64:Te0c,file/memory contains long string with (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SSL connect error" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Couldn't connect to server" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Couldn't bind to '%s'" (Indicator: " bind "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Couldn't bind to interface '%s'" (Indicator: " bind "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to connect to %s port %ld: %s" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "After %ldms connect time, move on!" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LDAP local: Cannot connect to %s:%ld" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LDAP local: bind via ldap_win_bind %s" (Indicator: " bind "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "WSAStartup failed (%d)" (Indicator: "wsastartup"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Ready to accept data connection from server" (Indicator: " accept "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to receive SOCKS4 connect request ack." (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client." (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " send "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SOCKS4 connect to IPv4 %s (locally resolved)" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Unable to send initial SOCKS5 request." (Indicator: " send "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to send SOCKS5 sub-negotiation request." (Indicator: " send "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to send SOCKS5 connect request." (Indicator: " send "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Failed to receive SOCKS5 connect request ack." (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SOCKS5 connect to IPv6 %s (locally resolved)" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SOCKS5 connect to IPv4 %s (locally resolved)" (Indicator: " connect "; File: "Anoma-dApp-installer_v1.31.5.msi")65:T88d,Observed email domain:"pop3." [Source: Anoma-dApp-installer_v1.31.5.msi] Observed email domain:"smtp." [Source: Anoma-dApp-installer_v1.31.5.msi] Observed email domain:"imap." [Source: Anoma-dApp-installer_v1.31.5.msi] Observed email domain:"kv.wp i y_i k d.yy i.y t ov.ch bmx.sx x m y_ya.cy$ p.w h_a(_q?u" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:".ds.s.b_x?: z.r a qb.1.m.rllix_g_u.cj.g.z w,l s o.c b_y.mx.3t!_x.86 j_g r_s.y_h_l vj.n c rx_f" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:"_b.n.h v mx.a_z5_s i ha.px.y x.u.s.c" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:".g.o v.lakc_jw k.sq_i m: w k.y.ilq_e*s.p1.z u.iwmx.y io l_p" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:"0.m_mx.rs_o.g.m_y_d%p.n.n#_n.f v.s_q_k.r_z_nh g f zsw.ln.1#_p_y x d_s(_bi s e_b_q_d.l o.eu_d p" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:".b_z.r_y vj_d? r).qb.w_w.0 ra+.i.mx.r.he.qx;_v_v j^i.g/.k h.e.tw_t v z q oot" [Source: 00000000-00005380.00000001.236929.0E651000.00000004.mdmp 00000000-00005380.00000002.237946.01140000.00000004.mdmp 00000000-00005380.00000002.237946.0E651000.00000004.mdmp] Observed email domain:"pop3." [Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp] Observed email domain:"smtp." [Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp] Observed email domain:"imap." [Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp]66:T2656,Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://www.flexerasoftware.com0" Pattern match: "www.digicert.com110/" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0o" Pattern match: "cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0p" Heuristic match: "ftp@example.com" Pattern match: "https://curl.haxx.se/docs/http-cookies.html#" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "https://www.globalsign.com/repository/03,0*0" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "www.memtest86.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.w3.org/1999/xsl/transform" Heuristic match: "-grp.gr" Heuristic match: ".grp.gr" Heuristic match: "krp.kr" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2019/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2020/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=228610" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851152" Pattern match: "https://go.microsoft.com/fwlink/?linkid=852747" Heuristic match: "nf.fr" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Heuristic match: "h@.bw" Heuristic match: "h`.bw" Heuristic match: "~.gfq.gfq.gf" Heuristic match: "~.gfq.gf" Heuristic match: "iq.gfq.gfq.gf" Heuristic match: "!gfq.gfq.gf" Heuristic match: "hfq.gfq.gfq.gf" Heuristic match: "hfq.gfq.gf" Heuristic match: "~.gfq.gfq.gfq.gf" Heuristic match: "iq.gf" Heuristic match: "!gfq.gfq.gfq.gf" Heuristic match: "iq.gfq.gf" Heuristic match: "hfq.gf" Heuristic match: "!gfq.gf" Heuristic match: "fq.gfq.gfq.gf" Pattern match: "jm.tk/.pg5zrk.3" Heuristic match: "g.a,1_p f r.c_r.to.v.k!.7.0_v.u1.np" Heuristic match: "_c.n_sm_i p x.p3.g_a.mr" Heuristic match: "x/_p.4 f.3 xb.4 d_i_h i.q_m_h.3.kc qo_g.a,so.r.hk+_fv+_o p)_c u_p ew9_e yl_n.j.x.w_b a>.mg" Heuristic match: "h_cs.y: zn?y.w|.x_cy_h2 h.k).m q ly.m.h_ed.g_y.o ph_i: l3_a@.sj.o.wf" Heuristic match: "v.z t96_w d4.bw" Pattern match: "k.wt/.d.e.j" Heuristic match: "v.t b e## n d th w r_y o6$ c su.l.cg" Heuristic match: "_d.c.f s(`& e3g.3c.e.n n xo_m o.as" Heuristic match: ".ot` j<.vf.2k_jiv s.5.s3:r.c^.c!v p\ z.m.s o.br" Heuristic match: "v v_o x.y.h_l.d.w.mjm.q.quk_e p.g{ z.sl" Heuristic match: "w.i m.b_lw.r oe}n v or_i_r.q\~kw[$_ss x a}0.o h_v.o yt.ee" Heuristic match: "6_o dg.y b x_j_r.0qg.s.b.a h_k}.i_td_l c_dx.c vp.u jc.m d eol w+c.4.w j.a o v@ r_k.nb.dk" Heuristic match: "_fw.x m c$ewu@.y8.m_t o_en.j8 k^c.mq" Heuristic match: ".t_i_ep.z_g i.3_c?[ g qga.0.z.b_s.v.w_w p_k k.n.d0 a d_v.pw" Heuristic match: "_b_z_h k_l o_b.o.lt" Pattern match: "z.ghu/.w.b.s~.0p" Pattern match: "j.gyy/.3_n" Heuristic match: "a_m]nz22.z.x_w.lr mt_vs.p_y{.ge v.g.gt" Heuristic match: "l y1_f.t_l_w_sh jp4gbgd.x.8.a_g k v`.xn" Heuristic match: "_lyg k_h.l_a<_c_xv*l_d_k.z p_j.s0_o.n.d t_fg.v/.gl" Heuristic match: "f h_y.om\q.uz_a naat wk_t.r.r a.z ki w.h_ha= q.m d ysi.p.w- r vr.cg.bw" Heuristic match: ".2 ry$ x_w_g_g a_bmd%x# k_m i i q r s23z_a v+ p.q.i_u w.t m_v.o d_m_lp.o/ s~ i f_v s y.a1.fm" Heuristic match: "6oya,.2.d.o.3_x_t v u3_d_at]&.l_d_n i_t_jk_i_u ys_h.q.8.j_m.1_l.sl" Heuristic match: "2.26o*qh= uz.q< a.w_e_x.m<_w q_jf k.t.a x_t.5.v_l_k ie.t.tj fb_y j.l g.me" Heuristic match: "_g_s=_tq p.g_wm ghc.z&_u u_xzjb.r.0.wj_x.5 y.e_sy z| d}.ji/ x.lh.ge" Pattern match: "e.uzem/.wv.g_p_t.e" Heuristic match: "_l.n^_n_m.t.o_q_c!.l.a!.hr" Pattern match: ".d.qs/_tm.s" Heuristic match: "a r czsr_h.c x s).a_d.o|55{.sh" Pattern match: "y.tu/.r_b_m&_r_pd" Pattern match: "zp.dr/.z" Heuristic match: "t.z5_b> b c2u_a_s b a! l z_b h a.i jh_y e p_o.pa" Heuristic match: "z f g5 i kyc.d_m.s5}v_s.jm" Heuristic match: "pvo.c.l.w j.hr%.d.d_co.m.k[ pa<(o.t6_e5.v j_b.je.m.p m_f i ut a l_tyb.z.ylndf o} n*.mk" Pattern match: "h.ud/:g5.w.je8.zn_u8_g.6.b" Heuristic match: "j y.mk u_k g.l.eji<_u.k.t d.v9d;x s i.k i>p.26_w&_k6 c}z y_b.mh.8_tq_l.k.i{.m3` q_k2.e p p.pe" Heuristic match: "mpya.rw" Pattern match: "qnn.ddm/nc_k.s.7+.dr" Heuristic match: "d.7.b4.u gp.g3n_x_i_x.o w!u r.t.dy& h.6 f_k_g_e_p.k.sz" Heuristic match: "z gh_e r_i_r- b.bh_rb dh i j9_m z.w v_f.3_z c8i_l_vu zg_f.n.x u.l l3 d.mq" Heuristic match: "9.o.pq.8j.k_x;_u.v_j) b.es.n.e_m_t_d b.ng" Heuristic match: "q[ k z_i_wsc.nc.e.b_v qp_a o_p.0 ui k_v r a_ba ez.p.u[y.gs" Heuristic match: "]_n.l h vn|)_or.x q b.c_e a_s<6_t v.n o.ip_v.e i j_ad.na" Heuristic match: "h.5_qz78.d e.9_qx& b d l p.s zdf.u+ v s_x.i$_v_k& z s}_q.xz[_a_vf.cna.ch" Heuristic match: ".j.y.y#.yi(v o.jl.k.v.e_o wo_c_zfa.s:.l.1_yg.oqj.p_b q[_l.m.f n_xu.fo" Pattern match: "z.z.yi/w}.e_p.i" Heuristic match: "c_yoz2_x.m c.8(} iit_q u o.gy_ya.v l.mg" Heuristic match: "b.jt.a.g.p t_w_l.6y9_x_t_u_y_hlh.bc4.w.va" Heuristic match: "855.y_e sw.a_c_h pr.g.r_z.f.3.b s_wh.p.u:.ii.6gea.x.do" Pattern match: "l.sj/_w-}_e_w_n" Pattern match: "q.cx/e.e.o.u_h" Heuristic match: "v.eq k.jk d-n a_lr cj.x t b.j_t z.fdw.t_n`m kd2 m n.cz" Heuristic match: ">_vxe_c r x b.x.e%zzx9_r/_e.j_u wrqx*.g,.z.f h_f b vxs.s.qb_n9_eq!.5 n<_ne.c_t_p%.bv" Heuristic match: "ke.f.x ae[7b_z.m.yy.63.z zc i_vm)% p y_k d.qv w_ch_l: r p r3 y d f/.iq x.bj" Heuristic match: "[_il_u_i.i cm.mv" Heuristic match: "y_ie b c h.k& q.6.i6 p1.v.f_o_s.y_z r.r.i a_r.ds_n.fn.k.u.n.q_v_b_l r1.ua" Heuristic match: "y v<.ye8\_n.tr.8_i r{ h.xh.3 w y k.t: ft%/[_c_r.a n.cf" Heuristic match: ".31 b_c b4_nj_o?t hy_y9(p.b_w5.g_k.m.ne" Heuristic match: "q c_r.h vg.u|m?,_j<.sj" Pattern match: "e.el/a2" Heuristic match: ".s_h lb.a j.nqkj.i_s q.i c ig.o_m_y1m.x-.s_p b_t.i_g?_g_q.bb" Heuristic match: ".v ek.a!_n n t_i_y.t_b bs.h_sti.7.9_mugo i a_y_p_p_h].v_k.et" Heuristic match: "g k.9f k=6;r w_m.is" Pattern match: "a.klr/il.1" Heuristic match: "c g.9r.j.h.a u.y z+li0d_t i_v> z_i zt.z[ t_i s.dq7.h)_wwe6a f.y#_x_o.en c]] f.yy.tc" Heuristic match: "p` m.dt.z_j.j;_xxb.z qd.g g.j r.x5.sc" Heuristic match: ".z_c.k_h o f_a_u}dl y r.rgx.d_wml` o_l/_v{b)i.m a_p_a_c_c1` p z)_c.p.m_w_w_s.x_ri.c.q r` p.gw" Heuristic match: "d8_w z c>.6.v l.yt g.5.r_ry n.ye" Heuristic match: "ux.u.p b.mq_m-k_l_r.q^o h_gi j.3m.kn" Pattern match: "w.cq/_p.r" Heuristic match: "x zj.b2.f.l_oh_q{ w5_s.s\.3 q g t_x c.z.u n.w] u_h|~~.a t.c_ic>.g.cm_o_u v_l.v h vs( m.gt" Heuristic match: "v j_fa_nw.6 pl py_x> a.n}.n.bi*~s u_xfe_p.r_n_rd f_w.h8.mw" Pattern match: "hei.k.z.n.mi/_x" Heuristic match: "c| a_a_p_z_g.2 e nj_p3.ai.4@,.f_p?}| k t n p.kgy_dm.na" Heuristic match: "n o.e_c nx.7g sw.t6st2//y dx@oa.gq" Heuristic match: "_l,63.t jq z y_g.hh.i jq.b.x.f.ep.rc& w-4.z i_j.jzze n_pf a2_q_b.e_y.cg.b_q_u.e_c q_hgs2.ua" Heuristic match: ".o_r q_z.l a_g.x.g_b.z i b_wc h.y_b.k_f.ww t1` k d_m|-.ve" Heuristic match: "x.t.g.t_f:.2_m_j t.w^ c i o.4 sw8j_h/.t i_h d.sm" Pattern match: ".k.wqxv.uh/.e.vo_m_l.in{_b.s" Heuristic match: "z.5* u x_s ji b s e_m w\$_n l_q_o\1_nz.d n_y e_n.ao" Heuristic match: ".nq.e.fl.0.r b_o n.to" Heuristic match: "<.a_m o.r.5.n.ab_nps y.xn9.et.x_x.x sa~4.s d.hs5 w ym g7p_g yq|y x.2 b_r.ch" Heuristic match: "5v_d_c_na7 u.x_g_l.q_ou.z c i.v.y.q_y.w_sv h.s_y.v.izj_h_p.bj" Heuristic match: "m_p z_k.3x_d.2 y! q_w p v_m!t_u].d.vsoq_x bf.n|.i_w:.9^.eo_s.k y_m.bg" Pattern match: "j.yh/.a.u.t_k.z" Pattern match: "m.0.sz/.2p" Heuristic match: "n u_m o lg r.w_hf_t`.d.s.fj d.6_n n_g yd_r.iq_b1 x f.y.y.w)hn.h(.h_s_h@.th" Heuristic match: "_mi[_v_v% t y l| j_p.t q w_u#.vk.8 h_r_c=_l wbfm_b_t_p.g_j.v_x_c!i_b_gti t.s.mp" Heuristic match: ".yl.x.j m.i yx.z.0.v h_y_dw_s k w vl_l ou.8_f>@ u.t_y_p e].m0;_e.ng" Heuristic match: "t f.y g.7.q_rc vz.o_n_i.n| d9.d.co" Heuristic match: "c#_u.zzeuo x.b4_c!ka_fm.a_u[.k2={_q_k_c.k.9.m_k_x.d.g.o]_e5 c.d_mv iz[.2_f j_c q g.dz" Heuristic match: "|w f9 f.h g%_j.i i.z w csv_p r.c ch l e v\.h h_g.t.1 c f1.f.sd" Heuristic match: "u.l.c.jmf6 p` u g_w.n_c.h c.5a_g.n.7_g.sy.m_k_l>x.v gb.n.z c.c.m_vk.sj" Heuristic match: "_b.l_yjr_v_ql2)f_n<.bx.y.sf_r.p.t_r.pf" Heuristic match: "kk.h.q8 i_p.6&_ha k.e.f.f_m i h.y4.h.z_zhh-]_m.vja#.a_w.f.a.i-_vf zk m.n cn.y_z p_u u_a;9bz.xn" Pattern match: "https://curl.haxx.se/docs/http-cookies.html"67:T5de,Found URL "http://www.w3.org/1999/xsl/transform'" - Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp") Found URL "http://www.w3.org/1999/xsl/transform'" - Source: "00000000-00005380.00000001.236929.00A90000.00000004.mdmp") Found URL "http://www.w3.org/1999/xsl/transform'" - Source: "00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found URL "ftp://%s:%s@%scontent-range:" - Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found URL "http:///logstores//shards/lbcontent-type:application/x-protobufx-log-apiversion:0.6.0x-log-compresstype:lz4x-acs-security-token:x-log-signaturemethod:hmac-sha1date:content-md5:content-length:%dx-log-bodyrawsize:%dhost:%s.%spostapplication/x-protobufx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-compresstype:lz4x-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-acs-security-token:%sx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-compresstype:lz4x-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbpostapplication/x-protobufx-acs-security-token:%sx-log-apiversion:0.6.0x-log-bodyrawsize:%dx-log-signaturemethod:hmac-sha1/logstores/%s/shards/lbauthorization:log" - Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")68:T41c,Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close!" (Indicator: "HTTP/1.1"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive!" (Indicator: "HTTP/1.0"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")69:Tca3,Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "## Fatal libcurl error" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "libcurl/7.64.1" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "CLIENT libcurl 7.64.1MATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "CLIENT libcurl 7.64.1DEFINE %s %sQUIT" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "CLIENT libcurl 7.64.1%sQUIT" (Indicator: "libcurl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "# Fatal libcurl error" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "libcurl/7.64.1" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "CLIENT libcurl 7.64.1" (Indicator: "libcurl"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")6a:Tb81,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")6b:Tbd7,Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")6c:T1400,Found registry query API: "RegOpenKeyTransactedA" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RegOpenKeyA" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RegOpenKeyExA" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RegQueryValueExA" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RegOpenKeyW" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RegQueryValueExW" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp"6d:T917,"installer.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter libcrypto-1_1.dll (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter libffi-7.dll (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter libssl-1_1.dll (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter python39.dll (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _bz2.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _ctypes.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _decimal.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _hashlib.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _lzma.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _socket.pyd (UID: 00000000-00008268) "installer.exe" called "FindNextFileW" with parameter _ssl.pyd (UID: 00000000-00008268) "installer.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI82682\*.* (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter libcrypto-1_1.dll (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter libffi-7.dll (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter libssl-1_1.dll (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter python39.dll (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00005228) "installer.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00005228)6e:T4f8,Found string "base64" (Indicator: "base64"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "PlaiDecodeBase64Char" (Indicator: "base64"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found string "PlaiBase64Decode" (Indicator: "base64"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found string "PlaiBase64Encode" (Indicator: "base64"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found string "The Diffie-Hellman group is not compatible with the policy type." (Indicator: "diffie-hellman"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")6f:T440,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")70:T132d,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Process32First" (Indicator: "Process32First"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")71:T42c,Found reference to API "ReadFile" (Indicator: "ReadFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")72:T464,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")73:T70d,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")74:T11d6,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetTempPath Failed." (Indicator: "GetTempPath"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetTempFileName Failed. The file was to be created in '%s.'" (Indicator: "GetTempFileName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")75:T421,Found reference to API "GetProcessId" (Indicator: "GetProcessId"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwWow64CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")76:T442,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")77:T18f1,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")78:T23da,file/memory contains long string with (Indicator: "password"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)" (Indicator: "password"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "password" (Indicator: "password"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "The Local Administrator Password Solution password update operation failed because the legacy LAPS schema needs to be added to Active Directory." (Indicator: "password"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")79:T5e6,Found registry deletion API: "RegDeleteValueA" in file "Anoma-dApp-installer_v1.31.5.msi" Found registry deletion API: "NtDeleteKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp"7a:T930,Found string "OpenProcess" (Indicator: "OpenProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") file/memory contains long string with (Indicator: "OpenProcess"; File: "VAgent.exe") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005380.00000002.237946.722F6000.00000002.mdmp")7b:Ta05,Found string "\Device\HarddiskVolume3\ProgramData\PMR_Make_beta\BetaC32.exe" (Indicator: "\Device\"; Source: "00000000-00004668-00000BC0-2663968354") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\installer.exe" (Indicator: "\Device\"; Source: "00000000-00005380-00000BC0-2667146658") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\VAgent.exe" (Indicator: "\Device\"; Source: "00000000-00005380-00000BC0-2680541642") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\Chime.exe" (Indicator: "\Device\"; Source: "00000000-00005380-00000BC0-2709584216") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000000.235011.01210000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.01210000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.01210000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000000.235011.01210000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.01210000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.01210000.00000004.mdmp") Found string "\Device\SrpDevice" (Indicator: "\Device\"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string "\Device\IPT" (Indicator: "\Device\"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found string ":\Windows\System32\Drivers\Driv" (Indicator: "\drivers\"; Source: "00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found string ":\Windows\System32\Drivers\Driv" (Indicator: "system32\drivers"; Source: "00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp")7c:T400,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")7d:T456,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")7e:T5fe,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")7f:T287f,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "PlaiAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found reference to API "PlaiAccessCheckFromDcsFile" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp") Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")80:T9d9,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "nISTerminateProcesses" (Indicator: "TerminateProcess"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")81:T434,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwWriteFile" (Indicator: "ZwWriteFile"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")82:T77a,"BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "RECVBUFFERSIZE"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "DISABLETLS1.3"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAMDATA\PMR_MAKE_BETA\BETAC32.EXE"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\ROAMING\PMR_MAKE_BETA\ANGRBCAYAEXRVTSLUP\INSTALLER.EXE"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\VAGENT.EXE"; Value: "") "BetaC32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\ROAMING\PMR_MAKE_BETA\CHIME.EXE"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\ROAMING\PMR_MAKE_BETA\ANGRBCAYAEXRVTSLUP\INSTALLER.EXE"; Value: "")83:T9fe,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp")84:T52c,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "Anoma-dApp-installer_v1.31.5.msi") Found reference to API "After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x." (Indicator: "ReleaseMutex"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletion" (Indicator: "ReleaseMutex"; Source: "00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp")85:T854,"python39.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\python39.dll]- [targetUID: 00000000-00005228] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libcrypto-1_1.dll]- [targetUID: 00000000-00008268] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libssl-1_1.dll]- [targetUID: 00000000-00008268] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI82682\VCRUNTIME140.dll]- [targetUID: 00000000-00005228] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\unicodedata.pyd]- [targetUID: 00000000-00008268] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_decimal.pyd]- [targetUID: 00000000-00008268] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_lzma.pyd]- [targetUID: 00000000-00008268] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ssl.pyd]- [targetUID: 00000000-00008268] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ctypes.pyd]- [targetUID: 00000000-00005228] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_bz2.pyd]- [targetUID: 00000000-00008268] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_socket.pyd]- [targetUID: 00000000-00008268] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_hashlib.pyd]- [targetUID: 00000000-00008268] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\select.pyd]- [targetUID: 00000000-00008268]86:Ta4d,"installer.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%APPDATA%\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\installer.exe]- [targetUID: 00000000-00005228] "python39.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\python39.dll]- [targetUID: 00000000-00005228] "libcrypto-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libcrypto-1_1.dll]- [targetUID: 00000000-00008268] "libssl-1_1.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 8 sections"- Location: [%TEMP%\_MEI82682\libssl-1_1.dll]- [targetUID: 00000000-00008268] "Chime.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\PMR_Make_beta\Chime.exe]- [targetUID: 00000000-00005380] "VAgent.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\VAgent.exe]- [targetUID: 00000000-00005380] "VCRUNTIME140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\_MEI82682\VCRUNTIME140.dll]- [targetUID: 00000000-00005228] "unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\unicodedata.pyd]- [targetUID: 00000000-00008268] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_decimal.pyd]- [targetUID: 00000000-00008268] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_lzma.pyd]- [targetUID: 00000000-00008268] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ssl.pyd]- [targetUID: 00000000-00008268] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ctypes.pyd]- [targetUID: 00000000-00005228] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_bz2.pyd]- [targetUID: 00000000-00008268] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_socket.pyd]- [targetUID: 00000000-00008268] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_hashlib.pyd]- [targetUID: 00000000-00008268] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\select.pyd]- [targetUID: 00000000-00008268]87:T12b8,"BetaC32.exe" wrote 44672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\Chime.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "BetaC32.exe" wrote 53644 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\PMR_Make_beta\ANGRBCAYAEXRVTSLUP\installer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "BetaC32.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\VAgent.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000580100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "installer.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libcrypto-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...88:T684,"BetaC32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8A7F948.tmp" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\base_library.zip" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libcrypto-1_1.dll" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libffi-7.dll" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\libssl-1_1.dll" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\python39.dll" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\select.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\unicodedata.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\VCRUNTIME140.dll" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_bz2.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ctypes.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_decimal.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_hashlib.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_lzma.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_socket.pyd" with delete access "installer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI82682\_ssl.pyd" with delete access89:T5aa,"unicodedata.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\unicodedata.pyd]- [targetUID: 00000000-00008268] "_decimal.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_decimal.pyd]- [targetUID: 00000000-00008268] "_lzma.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_lzma.pyd]- [targetUID: 00000000-00008268] "_ssl.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ssl.pyd]- [targetUID: 00000000-00008268] "_ctypes.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_ctypes.pyd]- [targetUID: 00000000-00005228] "_bz2.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_bz2.pyd]- [targetUID: 00000000-00008268] "_socket.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_socket.pyd]- [targetUID: 00000000-00008268] "_hashlib.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\_hashlib.pyd]- [targetUID: 00000000-00008268] "select.pyd" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\_MEI82682\select.pyd]- [targetUID: 00000000-00008268]8a:T749,Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6E3B061-8F58-4884-B71D-336E976051FC}" (UID: 00000000-00005808) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AD797BB-1F5A-44EE-8ECC-6AAFAB877FC8}" (UID: 00000000-00006132) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE504EF6-8665-40AE-A41D-11527A8DC9B8}" (UID: 00000000-00008180) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84887264-C02C-45BC-A248-5B1F2C8E3374}" (UID: 00000000-00006940) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F9FF893-FFB5-4031-BBC2-F805BA1FD482}" (UID: 00000000-00007804) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6C54818-63A3-4C70-81A0-82B395330EA7}" (UID: 00000000-00009016) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13CF953D-6C75-4997-AE08-B8550880BBE9}" (UID: 00000000-00008488) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{388F2163-71B2-4DB3-8286-24CDE2C5687A}" (UID: 00000000-00006872) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4545DCED-F950-4716-B658-78B8F111EFF5}" (UID: 00000000-00003776) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{643C4BF7-F018-430D-88FB-C5B370424223}" (UID: 00000000-00003608) Spawned process "BetaC32.exe" (UID: 00000000-00004668) Spawned process "BetaC32.exe" (UID: 00000000-00005380) Spawned process "installer.exe" (UID: 00000000-00008268) Spawned process "installer.exe" (UID: 00000000-00005228) Spawned process "VAgent.exe" (UID: 00000000-00004644) Spawned process "Chime.exe" (UID: 00000000-00002112)8b:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=8c:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790964500831,"unified_at":"2026-10-02T18:08:20.831Z","metadata":{"hashes":{"sha256":"911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9","sha1":"ccae17f7af60e39c547ac7564dc155b6f3e6802b","md5":"f5e9ce0c42b88b04e8f4996a75cb76d4","sha512":"29548385ca10dc91389bb973b8da976fc0491c5601d49f7f17c1c233eea3bb7e171d4e1404db9df5d4e36748ef7ed2c4e9931bf56ed3dd19d31ca8e2ded9fa6b","ssdeep":"786432:l50fowKEGnw8yRB0jctfLdJ4RndYOJNU9PXiQo1Jrix3rYYlQCod1D72tAtn:l+UDnw8ycjJRnqOJNU9f3o1g9plajfvt","ssdeep_chunks":["786432:l50fowK","786432:50fowKE","786432:0fowKEG","786432:fowKEGn","786432:owKEGnw","786432:wKEGnw8","786432:KEGnw8y","786432:EGnw8yR","786432:Gnw8yRB","786432:nw8yRB0","786432:w8yRB0j","786432:8yRB0jc","786432:yRB0jct","786432:RB0jctf","786432:B0jctfL","786432:0jctfLd","786432:jctfLdJ","786432:ctfLdJ4","786432:tfLdJ4R","786432:fLdJ4Rn","786432:LdJ4Rnd","786432:dJ4RndY","786432:J4RndYO","786432:4RndYOJ","786432:RndYOJN","786432:ndYOJNU","786432:dYOJNU9","786432:YOJNU9P","786432:OJNU9PX","786432:JNU9PXi","786432:NU9PXiQ","786432:U9PXiQo","786432:9PXiQo1","786432:PXiQo1J","786432:XiQo1Jr","786432:iQo1Jri","786432:Qo1Jrix","786432:o1Jrix3","786432:1Jrix3r","786432:Jrix3rY","786432:rix3rYY","786432:ix3rYYl","786432:x3rYYlQ","786432:3rYYlQC","786432:rYYlQCo","786432:YYlQCod","786432:YlQCod1","786432:lQCod1D","786432:QCod1D7","786432:Cod1D72","786432:od1D72t","786432:d1D72tA","786432:1D72tAt","786432:D72tAtn","1572864:l50fowK","1572864:50fowKE","1572864:0fowKEG","1572864:fowKEGn","1572864:owKEGnw","1572864:wKEGnw8","1572864:KEGnw8y","1572864:EGnw8yR","1572864:Gnw8yRB","1572864:nw8yRB0","1572864:w8yRB0j","1572864:8yRB0jc","1572864:yRB0jct","1572864:RB0jctf","1572864:B0jctfL","1572864:0jctfLd","1572864:jctfLdJ","1572864:ctfLdJ4","1572864:tfLdJ4R","1572864:fLdJ4Rn","1572864:LdJ4Rnd","1572864:dJ4RndY","1572864:J4RndYO","1572864:4RndYOJ","1572864:RndYOJN","1572864:ndYOJNU","1572864:dYOJNU9","1572864:YOJNU9P","1572864:OJNU9PX","1572864:JNU9PXi","1572864:NU9PXiQ","1572864:U9PXiQo","1572864:9PXiQo1","1572864:PXiQo1J","1572864:XiQo1Jr","1572864:iQo1Jri","1572864:Qo1Jrix","1572864:o1Jrix3","1572864:1Jrix3r","1572864:Jrix3rY","1572864:rix3rYY","1572864:ix3rYYl","1572864:x3rYYlQ","1572864:3rYYlQC","1572864:rYYlQCo","1572864:YYlQCod","1572864:YlQCod1","1572864:lQCod1D","1572864:QCod1D7","1572864:Cod1D72","1572864:od1D72t","1572864:d1D72tA","1572864:1D72tAt","1572864:D72tAtn","786432:l+UDnw8","786432:+UDnw8y","786432:UDnw8yc","786432:Dnw8ycj","786432:nw8ycjJ","786432:w8ycjJR","786432:8ycjJRn","786432:ycjJRnq","786432:cjJRnqO","786432:jJRnqOJ","786432:JRnqOJN","786432:RnqOJNU","786432:nqOJNU9","786432:qOJNU9f","786432:OJNU9f3","786432:JNU9f3o","786432:NU9f3o1","786432:U9f3o1g","786432:9f3o1g9","786432:f3o1g9p","786432:3o1g9pl","786432:o1g9pla","786432:1g9plaj","786432:g9plajf","786432:9plajfv","786432:plajfvt"],"imphash":"Unknown"},"file_info":{"file_name":"Anoma-dApp-installer_v1.31.5.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":38637428,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1758828066000,"last_seen":1758830325000,"last_multi_scan":1758830325000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":87},"sandbox_signatures":{"informative_count":220,"suspicious_count":9,"malicious_count":3,"total":232},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.GRIP-7561","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"ABTrojan.GRIP","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Able to access mailslot-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"informative","value":"YARA signature match - Possible payload download using Office macros"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve the system language code"},{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"},{"type":"informative","value":"YARA signature match – Bzip compression loop"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"_lzma.pyd\")\n file/memory contains long string(File: \"_bz2.pyd\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"installer.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\_MEI82682 (UID: 00000000-00008268)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005380.00000000.235011.01210000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000000.235011.0DED0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000001.236929.01210000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000002.237946.01140000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000002.237946.01210000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005380-238-23-002E8AF8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005380-238-24-002E8882\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005380-238-115-002F2BA1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005380-238-879-002EAEC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"PlaiDecodeBase64Char\" (Indicator: \"decodebase64\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$33","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found string \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield_%s\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"_socket.pyd\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"RtlGetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"RtlpGetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"NtQueryDefaultUILanguage\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"NtQueryInstallUILanguage\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ISBEW64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005808)\n \"ISBEW64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006132)\n \"ISBEW64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008180)\n \"ISBEW64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006940)\n \"ISBEW64.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ISBEW64.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005808)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"VAgent.exe\" called \"IsWow64Process\" with parameter \"4644\" - (UID: 00000000-00004644)\n \"Chime.exe\" called \"IsWow64Process\" with parameter \"2112\" - (UID: 00000000-00002112)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"installer.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00005228)\n \"installer.exe\" called \"GetWindowTextW\" with parameter \"A critical error occurred during startup.Error code: 0x8007045DThe application will be closed.\" - (UID: 00000000-00005228)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00005380-238-442-002E5D70\n GetTickCount@KERNEL32.DLL at 00000000-00005380-238-531-002EBD8E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005380-238-276-002E95AF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005380-238-531-002EBD8E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005380-238-276-002E95AF\n GetLocalTime@KERNEL32.DLL at 00000000-00005380-238-365-002E5A50\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005380-238-531-002EBD8E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00005380-238-395-002F3147","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ISBEW64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"BetaC32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"BetaC32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"installer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"installer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"VAgent.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Chime.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set timeouts for state %d; Total %ld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"Set ExternalUIHandler error, error is 0x%lx\" (Indicator: \"set \"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwQueryVolumeInformationFile\" (Indicator: \"ZwQueryVolumeInformationFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: Anoma-dApp-installer_v1.31.5.msi\n Observed string: \"Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp\n 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp\n 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp\n 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00005380.00000002.237946.002F5000.00000002.mdmp\n 00000000-00005380.00000002.237946.722F6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ISBEW64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BetaC32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"VAgent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Chime.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"installer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI82682\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"ZwCreateKey\" in \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyTransacted\" in \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyedEvent\" in \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"VAgent.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Chime.exe\")\n file/memory contains long string(File: \"VAgent.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"installer.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\_MEI82682 (UID: 00000000-00008268)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"installer.exe\" called \"CreateProcessW\" with parameter \"%APPDATA%\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe\" - (UID: 00000000-00008268)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$44","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\AWork\\share_lib\\99_PublicLibrary\\AliyunLog\\UserInfoCollect\\Release\\AliyunWrap.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$45","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00005380-238-17-002EAED2\n Sleep@KERNEL32.DLL at 00000000-00005380-238-38-002F07A3\n Sleep@KERNEL32.DLL at 00000000-00005380-238-49-002F07E8\n Sleep@KERNEL32.DLL at 00000000-00005380-238-200-002F0834\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005380-238-211-002E8430\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005380-238-469-002E1AA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00005380-238-20-002F0D3C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"ShellExecute failed.\" (Indicator: \"ShellExecute\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"ShellExecute returned:\" (Indicator: \"ShellExecute\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"PlaiStartService\" (Indicator: \"StartService\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"installer.exe\" with parameter %TEMP%\\_MEI82682 (UID: 00000000-00008268)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$50","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"installer.exe\" failed to load missing module \"%TEMP%\\_MEI82682\\python3\" - [base:0; Status:c0000135]\n \"installer.exe\" failed to load missing module \"python3\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$51","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$53","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 72620000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 723D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 08FD0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 09890000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75BF0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72680000\n \"ISBEW64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 09890000\n \"installer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 09890000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0AFA0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76AB0000\n \"ISBEW64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0AFA0000\n \"BetaC32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76AB0000\n \"installer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0AFA0000\n \"VAgent.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76AB0000\n \"Chime.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76AB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042ca09ff7f0000@ntdll.dll\"\n \"22002300000000004042ca09ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$54","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$55","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"ISBEW64.exe\" touched \"PSDispatch\" (Path: \"HKCU\\CLSID\\{00020420-0000-0000-C000-000000000046}\")\n \"ISBEW64.exe\" touched \"ItemMoniker\" (Path: \"HKCU\\CLSID\\{00000304-0000-0000-C000-000000000046}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ISBEW64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ISBEW64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"BetaC32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Chime.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"VAgent.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"BetaC32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\8A7F948.tmp\"\n \"BetaC32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\9041F02.tmp\"\n \"BetaC32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\93934FC.tmp\"\n \"installer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI82682\\VCRUNTIME140.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"installer.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"448\"\n \"BaseAddress\": \"00000237F9460000\"\n \"Buffer\": \"000001735ED259B0\"\n \"NumberOfBytesToWrite\": \"000011C0\"\n \"$name\": \"C:\\\\Users\\\\%OSUSER%\\\\AppData\\\\Roaming\\\\PMR_Make_beta\\\\ANGRBCAYAEXRVTSLUP\\\\installer.exe\"}\n \"installer.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"448\"\n \"BaseAddress\": \"000000ABB9FC82D8\"\n \"Buffer\": \"0000006789DE6E10\"\n \"NumberOfBytesToWrite\": \"00000008\"\n \"$name\": \"C:\\\\Users\\\\%OSUSER%\\\\AppData\\\\Roaming\\\\PMR_Make_beta\\\\ANGRBCAYAEXRVTSLUP\\\\installer.exe\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00005380-238-364-002E5DE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"NtRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ISBEW64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"8A7F948.tmp\" has type \"data\" - Location: [%TEMP%\\8A7F948.tmp]\n \"93934FC.tmp\" has type \"data\" - Location: [%TEMP%\\93934FC.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$5d","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"installer.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI82682\\_bz2.pyd\"\n \"installer.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI82682\\_ctypes.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ISBEW64.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe\" (UID: 5808)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ISBEW64.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\{092f7c51-eafb-422a-bd0a-cd79db4f760a}\\isbew64.exe\"\n \"ISBEW64.exe\" reads file \"c:\\windows\\system32\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$62","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"_socket.pyd\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open/close a dial up connection (API string)","description":"Found reference to API \"InternetAutodial\" (Indicator: \"InternetAutodial\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1011","relevance":1,"id":"string-540","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005380.00000002.237946.722F6000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"smtp.\" (Indicator: \"smtp\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$65","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"127.0.0.1/\"\n Potential IP \"3.2.9.0\" found in string \"3.2.9.0 vr C.1] O_fz.W.y_Zu.M_X_t.4.X.K.4.d.o8.k! N/&q_S>!_B0_j.\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$67","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://d.symcb.com\"\n Found HTTPS url \"https://www.digicert.com\"\n Found HTTPS url \"https://curl.haxx.se\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$69","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-1_1.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file file \"installer.exe\"\n YARA signature to detect high entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"VCRUNTIME140.dll\"\n YARA signature to detect medium entropy file file \"select.pyd\"\n YARA signature to detect medium entropy file file \"libcrypto-1_1.dll\"\n YARA signature to detect medium entropy file process \"00000000-00005380\"\n YARA signature to detect medium entropy file file \"VAgent.exe\"\n YARA signature to detect medium entropy file file \"_decimal.pyd\"\n YARA signature to detect medium entropy file file \"_hashlib.pyd\"\n YARA signature to detect medium entropy file file \"python39.dll\"\n YARA signature to detect medium entropy file file \"_bz2.pyd\"\n YARA signature to detect medium entropy file file \"_lzma.pyd\"\n YARA signature to detect medium entropy file file \"_socket.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible payload download using Office macros","description":"YARA signature for payload download using Office macros matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1204.002","relevance":5,"id":"yara-28","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"VCRUNTIME140.dll\"\n YARA signature for RC4 encryption matched on file \"unicodedata.pyd\"\n YARA signature for RC4 encryption matched on file \"libcrypto-1_1.dll\"\n YARA signature for RC4 encryption matched on process \"00000000-00005380\"\n YARA signature for RC4 encryption matched on file \"VAgent.exe\"\n YARA signature for RC4 encryption matched on file \"Chime.exe\"\n YARA signature for RC4 encryption matched on file \"_decimal.pyd\"\n YARA signature for RC4 encryption matched on file \"installer.exe\"\n YARA signature for RC4 encryption matched on file \"python39.dll\"\n YARA signature for RC4 encryption matched on file \"_bz2.pyd\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on file \"libssl-1_1.dll\"\n YARA signature for RC4 encryption matched on file \"_socket.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Bzip compression loop","description":"YARA signature for bzip compression loop used in file \"_bz2.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-128","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ISBEW64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"installer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"VAgent.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Chime.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"VAgent.exe\" called \"GetComputerNameW\" (UID: 00000000-00004644)\n \"Chime.exe\" called \"GetComputerNameW\" (UID: 00000000-00002112)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"gethostname() failed, continuing without!\" (Indicator: \"gethostname\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005380.00000001.236929.0E651000.00000004.mdmp, 00000000-00005380.00000002.237946.01140000.00000004.mdmp, 00000000-00005380.00000002.237946.0E651000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")\n Found reference to API \"NtGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005380.00000002.237946.002F5000.00000002.mdmp, 00000000-00005380.00000002.237946.722F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"RtlCheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"i9DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$78","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: Anoma-dApp-installer_v1.31.5.msi\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: Anoma-dApp-installer_v1.31.5.msi\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: Anoma-dApp-installer_v1.31.5.msi\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield_%s\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: Anoma-dApp-installer_v1.31.5.msi","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"Found reference to API \"The range specified in NtUnlockFile was not locked.\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"NtLockFile\" (Indicator: \"NtLockFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")\n Found reference to API \"NtUnlockFile\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$81","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"installer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$82","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000000.235011.0DB65000.00000004.mdmp, 00000000-00005380.00000000.235011.0DED0000.00000004.mdmp, 00000000-00005380.00000000.235011.0E3A3000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.0E3A3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$85","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"8A7F948.tmp has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"installer.exe\" - Location: [%APPDATA%\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe]- [targetUID: 00000000-00005228]\n Dropped file: \"Chime.exe\" - Location: [%APPDATA%\\PMR_Make_beta\\Chime.exe]- [targetUID: 00000000-00005380]\n Dropped file: \"VAgent.exe\" - Location: [%LOCALAPPDATA%\\VAgent.exe]- [targetUID: 00000000-00005380]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"BetaC32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"VAgent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Chime.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"Anoma-dApp-installer_v1.31.5.msi\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"installer.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00008268)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-10-002EA8D7\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-16-002EA7EB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-17-002EAED2\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-21-002EA770\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-47-002EAF2B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005380-238-502-002EAB80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005380-238-656-002E8CFF\n GetStartupInfoA@KERNEL32.DLL at 00000000-00005380-238-662-002EB8CF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"BetaC32.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{724577A2-6AE2-4B62-BDC7-1254584EE259}\\AliyunConfig.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$86","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$87","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005380.00000000.235011.00A90000.00000004.mdmp, 00000000-00005380.00000001.236929.00A90000.00000004.mdmp, 00000000-00005380.00000002.237946.00A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$88","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$89","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Compound file contains data exceeding the last FAT sector (overlay)","description":"\"Anoma-dApp-installer_v1.31.5.msi\" has \"0\" bytes of overlay at offset \"36212\"\n \"Anoma-dApp-installer_v1.31.5.msi\" has \"38553600\" bytes of overlay at offset \"83828\"","origin":"Static Parser","relevance":10,"id":"static-76","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"installer.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe\" (Handle: 448)\n \"installer.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe\" (Handle: 448)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$8a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to query network adapter information"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Compound file contains data exceeding the last FAT sector (overlay)"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}]},"activity":{"stats":{"process_count":19,"spawned_processes_count":19,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":46,"imported_dlls_count":95,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"68d59ef349b891710a086790","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Anoma-dApp-installer_v1.31.5.msi","analysis_start_time":"2025-09-25T19:58:46+00:00","indicators_count":{"informative":220,"suspicious":49,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}],"processes":[{"pid":9036,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\Anoma-dApp-installer_v1.31.5.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00009036","icon":"$8b"},{"pid":3872,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00003872","icon":"$8c"},{"pid":5224,"ppid":3872,"name":"MsiExec.exe","command_line":"-Embedding 11DD81761381146B80DA49CA5A69E601 C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003872","uid":"00000000-00005224"},{"pid":5808,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6E3B061-8F58-4884-B71D-336E976051FC}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00005808"},{"pid":6132,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AD797BB-1F5A-44EE-8ECC-6AAFAB877FC8}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00006132"},{"pid":8180,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE504EF6-8665-40AE-A41D-11527A8DC9B8}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00008180"},{"pid":6940,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84887264-C02C-45BC-A248-5B1F2C8E3374}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00006940"},{"pid":7804,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F9FF893-FFB5-4031-BBC2-F805BA1FD482}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00007804"},{"pid":9016,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6C54818-63A3-4C70-81A0-82B395330EA7}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00009016"},{"pid":8488,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13CF953D-6C75-4997-AE08-B8550880BBE9}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00008488"},{"pid":6872,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{388F2163-71B2-4DB3-8286-24CDE2C5687A}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00006872"},{"pid":3776,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4545DCED-F950-4716-B658-78B8F111EFF5}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00003776"},{"pid":3608,"ppid":5224,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{643C4BF7-F018-430D-88FB-C5B370424223}","sha256":"8023e720f5a4b859e7ba5390037d4a08d7962d0a5af41c182806d403ea80fda9","normalized_path":"%TEMP%\\{092F7C51-EAFB-422A-BD0A-CD79DB4F760A}\\ISBEW64.exe","parent_uid":"00000000-00005224","uid":"00000000-00003608"},{"pid":4668,"ppid":5224,"name":"BetaC32.exe","command_line":"","sha256":"440106f3eeef7ebf9bf844e7254e91feb5c9b8c20367d2d6b56c95ae50e5b89c","normalized_path":"%TEMP%\\{724577A2-6AE2-4B62-BDC7-1254584EE259}\\BetaC32.exe","parent_uid":"00000000-00005224","uid":"00000000-00004668"},{"pid":5380,"ppid":4668,"name":"BetaC32.exe","command_line":"","sha256":"440106f3eeef7ebf9bf844e7254e91feb5c9b8c20367d2d6b56c95ae50e5b89c","normalized_path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\BetaC32.exe","parent_uid":"00000000-00004668","uid":"00000000-00005380"},{"pid":8268,"ppid":5380,"name":"installer.exe","command_line":"","sha256":"ec288a85a08c10e4d6cb4d19a4ec4f1ba8d24e03513a3fe3e397c0021449723a","normalized_path":"%APPDATA%\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe","parent_uid":"00000000-00005380","uid":"00000000-00008268"},{"pid":5228,"ppid":8268,"name":"installer.exe","command_line":"","sha256":"ec288a85a08c10e4d6cb4d19a4ec4f1ba8d24e03513a3fe3e397c0021449723a","normalized_path":"%APPDATA%\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe","parent_uid":"00000000-00008268","uid":"00000000-00005228"},{"pid":4644,"ppid":5380,"name":"VAgent.exe","command_line":"","sha256":"f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669","normalized_path":"%LOCALAPPDATA%\\VAgent.exe","parent_uid":"00000000-00005380","uid":"00000000-00004644"},{"pid":2112,"ppid":5380,"name":"Chime.exe","command_line":"","sha256":"adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c","normalized_path":"%APPDATA%\\PMR_Make_beta\\Chime.exe","parent_uid":"00000000-00005380","uid":"00000000-00002112"}],"all_imported_dlls":["ucrtbase.dll","comctl32.dll","oleaut32.dll","netapi32.dll","CoreMessaging.dll","fltLib.dll","cryptsp.dll","IPHLPAPI.DLL","advapi32.dll","propsys.dll","profapi.dll","ISRT.dll","comdlg32.dll","sxs.dll","libffi-7.dll","ntdll.dll","pcacli.dll","urlmon.dll","cabinet.dll","DXCore.dll","VxSSL32.dll","sechost.dll","shell32.dll","bcryptprimitives.dll","version.dll","iertutil.dll","nsi.dll","coml2.dll","kernel.appcore.dll","TextInputFramework.dll","msihnd.dll","riched20.dll","psapi.dll","AliyunWrap.dll","vsstrace.dll","ole32.dll","WinTypes.dll","ntmarta.dll","tdh.dll","wevtapi.dll","d3d9.dll","VCRUNTIME140.dll","KernelBase.dll","shlwapi.dll","win32u.dll","windows.storage.dll","usp10.dll","pdh.dll","clbcatq.dll","VxSSL64.dll","rpcrt4.dll","dwmapi.dll","cryptbase.dll","user32.dll","imm32.dll","msctf.dll","SHCore.dll","mpr.dll","gdi32full.dll","combase.dll","bcrypt.dll","uxtheme.dll","TextShaping.dll","wkscli.dll","riched32.dll","Wldap32.dll","msvcrt.dll","wow64win.dll","msls31.dll","_isres_0x0409.dll","srvcli.dll","srpapi.dll","mscoreei.dll","sspicli.dll","wow64cpu.dll","vssapi.dll","apphelp.dll","msi.dll","wow64con.dll","pla.dll","python39.dll","rsaenh.dll","gdi32.dll","wldp.dll","wow64.dll","wininet.dll","CoreUIComponents.dll","kernel32.dll","AcLayers.dll","msvcp_win.dll","netutils.dll","mscoree.dll","wow64base.dll","GdiPlus.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"installer.exe","sha256":"c7f163889fc0659db14dad15941569052de729747a1204ddd07d68df4d877b18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Chime.exe","sha256":"adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"VAgent.exe","sha256":"f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"VCRUNTIME140.dll","sha256":"ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_bz2.pyd","sha256":"fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_decimal.pyd","sha256":"ffbe84f0a1eab363ca9cf73efb7518f2abd52c0893c7cc63266613c930855e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_hashlib.pyd","sha256":"9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_lzma.pyd","sha256":"b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_socket.pyd","sha256":"4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"libcrypto-1_1.dll","sha256":"594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"libssl-1_1.dll","sha256":"9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"python39.dll","sha256":"0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"select.pyd","sha256":"1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"unicodedata.pyd","sha256":"7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"8A7F948.tmp","sha256":"f11dce44fe738aef7e397b896e6008d8078c0f0bbdb1dce8f0cf649100e2b3b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"93934FC.tmp","sha256":"227e94a3217da6661b49e9229e136dbd5dee3229bd15f520696ed8fb6c4b6572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_ctypes.pyd","sha256":"3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"_ssl.pyd","sha256":"8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"base_library.zip","sha256":"c550b1290d063f3ed200f9287b5c478d286a577cbb80c088e0dc5d294779d8ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"overlay_5ec25a95aa22c048ab8ada2ae8fe23cca9e262f9f6daae8956a3923849d91de5","sha256":"5ec25a95aa22c048ab8ada2ae8fe23cca9e262f9f6daae8956a3923849d91de5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\{724577A2-6AE2-4B62-BDC7-1254584EE259}\\Stirthien.naz","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\AliyunConfig.ini","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\AliyunWrap.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\BetaC32.exe","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\Stirthien.naz","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%ALLUSERSPROFILE%\\PMR_Make_beta\\Geandklaelbreert.zqx","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\8A7F948.tmp","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%APPDATA%\\PMR_Make_beta\\Chime.exe","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%APPDATA%\\PMR_Make_beta\\ANGRBCAYAEXRVTSLUP\\installer.exe","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\9041F02.tmp","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\93934FC.tmp","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%LOCALAPPDATA%\\VAgent.exe","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\python39.dll","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\select.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"path":"%TEMP%\\_MEI82682\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:5808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:6132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:6132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8180:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:8180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:8180:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6940:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:6940:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:7804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:7804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:9016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:9016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8488:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:8488:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6872:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:6872:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:6872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:3776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:3776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:3608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:3608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:5228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"SM0:5228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]},{"name":"Local\\SM0:5228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68d59ef349b891710a086790"}]}]}},"report_ids":{"sandbox_job_ids":["68d59ef349b891710a086790"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious ABTrojan.GRIP Sample 911fc84b673d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 911fc84b673d…. Malware family: ABTrojan.GRIP. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9"}],["$","meta","4",{"property":"og:title","content":"Malicious ABTrojan.GRIP Sample 911fc84b673d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 911fc84b673d…. Malware family: ABTrojan.GRIP. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/911fc84b673d9e63ce79a859dc917439287fe552ef1c92dfdcb4d7cf744416d9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious ABTrojan.GRIP Sample 911fc84b673d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 911fc84b673d…. Malware family: ABTrojan.GRIP. Threat score 100/100. 1/26 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8d","11",{}]]