33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 50:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T432,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "ChestCounter.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ChestCounter.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ChestCounter.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ChestCounter.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ChestCounter.exe") Found reference to API "g____PInvoke|41_0" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "OpenThreadHandle" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")36:Tae7,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ChestCounter.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ChestCounter.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ChestCounter.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ChestCounter.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "ChestCounter.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "ChestCounter.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ChestCounter.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "ChestCounter.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "ChestCounter.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "ChestCounter.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "ChestCounter.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")37:T8fa,Found PE header "MZ" - Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A4870000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp")38:Ta15,Found string "ttps://github.com/LED-N/Fortnite-ChestCounter" (Indicator: "github.com"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found string "ttps://api.github.com/repos/LED-N/Fortnite-ChestCounter/releases/latest" (Indicator: "github.com"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found string "RepositoryUrl https://github.com/dotnet/dotnet" (Indicator: "github.com"; Source: "00000000-00004828.00000000.270235.A4C01000.00000020.mdmp, 00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp, 00000000-00004828.00000000.270235.A8611000.00000020.mdmp, 00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000001.272154.A4A30000.00000004.mdmp, 00000000-00004828.00000001.272154.A4A40000.00000004.mdmp, 00000000-00004828.00000001.272154.A4A61000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A4D90000.00000004.mdmp, 00000000-00004828.00000001.272154.A6260000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000001.272154.A63C1000.00000020.mdmp, 00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A48C0000.00000004.mdmp, 00000000-00004828.00000002.274077.A4A80000.00000004.mdmp, 00000000-00004828.00000002.274077.A4E10000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000002.274077.A6351000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp, 00000000-00004828.00000002.274077.A8560000.00000004.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp, 00000000-00004828.00000003.281503.A4870000.00000004.mdmp, 00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp, 00000000-00004828.00000003.281503.A4E31000.00000020.mdmp, 00000000-00004828.00000003.281503.A6211000.00000020.mdmp, 00000000-00004828.00000003.281503.A6290000.00000004.mdmp, 00000000-00004828.00000003.281503.A6380000.00000004.mdmp, 00000000-00004828.00000003.281503.A6400000.00000004.mdmp, 00000000-00004828.00000003.281503.A8520000.00000004.mdmp, 00000000-00004828.00000003.281503.A8541000.00000020.mdmp, 00000000-00004828.00000003.281503.A8E00000.00000004.mdmp, 00000000-00004828.00000003.281503.A8E10000.00000004.mdmp, 00000000-00004828.00000003.281503.A8E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A8E71000.00000020.mdmp, 00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp, 00000000-00004828.00000003.281503.AB1A1000.00000020.mdmp")39:T491,Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "EnumWindowsCallback" (Indicator: "enumwindows"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")3a:T4c4,Found reference to API "g____PInvoke|3_0" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "EnumWindowsCallback" (Indicator: "EnumWindows"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")3b:Tc87,Found string "set_UseShellExecute" (Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "ProcessStartInfo" (Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found string "antGetProcessStartInfo" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "antSetProcessStartInfo" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "ProcessStartInfo.LoadUserProfile and ProcessStartInfo.UseCredentialsForNetworkingOnly cannot both be set. Use only one of them." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "lProcessStartInfo.Password and ProcessStartInfo.PasswordInClearText cannot both be set. Use only one of them." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "NThe FileName property should not be a directory unless UseShellExecute is set." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "2UseShellExecute is not supported on this platform." (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "get_UseShellExecuteNotSupported" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "k__BackingField" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "get_UseShellExecute" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "get_CantGetProcessStartInfo" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found string "get_CantSetProcessStartInfo" (Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")3c:T804,"ChestCounter.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\shell32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter icu.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00004828) "ChestCounter.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00004828)3d:T4b76,"ChestCounter.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter InitializeContext2 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter QueueUserAPC2 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RtlGrowFunctionTable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter AllocConsole (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetClassNameWW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetLargestConsoleWindowSize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleWindowInfo (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_charsToUChars (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_getVersion (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_strcmp (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_strcpy (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_strlen (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_strncpy (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_tolower (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_toupper (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter u_uastrncpy (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ubrk_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ubrk_openRules (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_add (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_get (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getAttribute (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getKeywordValuesForLocale (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getLimit (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getNow (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getTimeZoneDisplayName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getTimeZoneIDForWindowsID (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_getWindowsTimeZoneID (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_openTimeZoneIDEnumeration (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_set (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucal_setMillis (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_closeElements (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_getOffset (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_getRules (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_getSortKey (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_getStrength (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_getVersion (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_next (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_previous (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_openElements (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_openRules (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_setAttribute (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_setMaxVariable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_strcoll (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_countSymbols (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_format (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_getSymbols (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_setCalendar (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udat_toPattern (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udatpg_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udatpg_getBestPattern (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter udatpg_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uenum_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uenum_count (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uenum_next (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uidna_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uidna_nameToASCII (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uidna_nameToUnicode (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uidna_openUTS46 (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_canonicalize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_countAvailable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getAvailable (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getBaseName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getCharacterOrientation (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getCountry (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getDefault (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getDisplayCountry (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getDisplayLanguage (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getDisplayName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getISO3Country (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getISO3Language (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getKeywordValue (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getLanguage (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getLCID (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_getParent (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uloc_setKeywordValue (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ulocdata_getCLDRVersion (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ulocdata_getMeasurementSystem (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_getNFCInstance (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_getNFDInstance (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_getNFKCInstance (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_getNFKDInstance (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_isNormalized (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unorm2_normalize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unum_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unum_getAttribute (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unum_getSymbol (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unum_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter unum_toPattern (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ures_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ures_getByKey (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ures_getSize (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ures_getStringByIndex (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ures_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_first (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_getBreakIterator (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_getMatchedLength (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_last (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_openFromCollator (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_setPattern (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter usearch_setText (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_clone (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucurr_forLocale (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucurr_getName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uldn_close (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uldn_keyValueDisplayName (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter uldn_open (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ucol_safeClone (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter BCryptHash (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FillConsoleOutputCharacterW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FillConsoleOutputAttribute (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleCursorPosition (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetConsoleCursorInfo (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleCursorInfo (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter ReadConsoleInputW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter SetProcessInformation (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004828) "ChestCounter.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004828)3e:T63e,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "ChestCounter.exe") Found reference to API "g____PInvoke|10_0" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "StartWithCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "CreateProcessWT" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "CreateProcessWithLogonWT" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")3f:Tf03d,Found reference to API (Indicator: "RevertToSelf"; File: "ChestCounter.exe") Found reference to API (Indicator: "RegGetValueW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "ChestCounter.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "ChestCounter.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "ChestCounter.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadToken"; File: "ChestCounter.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "ChestCounter.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "ChestCounter.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "ChestCounter.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "ReportEventW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "ChestCounter.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "EventWrite"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "ChestCounter.exe") Found reference to API (Indicator: "RegCloseKey"; File: "ChestCounter.exe") Found reference to API (Indicator: "EventRegister"; File: "ChestCounter.exe") Found reference to API (Indicator: "FindClose"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ChestCounter.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "WriteFile"; File: "ChestCounter.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetFilePointer"; File: "ChestCounter.exe") Found reference to API (Indicator: "HeapDestroy"; File: "ChestCounter.exe") Found reference to API (Indicator: "HeapFree"; File: "ChestCounter.exe") Found reference to API (Indicator: "EncodePointer"; File: "ChestCounter.exe") Found reference to API (Indicator: "IsProcessInJob"; File: "ChestCounter.exe") Found reference to API (Indicator: "ExitProcess"; File: "ChestCounter.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "ChestCounter.exe") Found reference to API (Indicator: "DecodePointer"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetFileSize"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlUnwind"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetErrorMode"; File: "ChestCounter.exe") Found reference to API (Indicator: "SignalObjectAndWait"; File: "ChestCounter.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "ChestCounter.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "ChestCounter.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "ChestCounter.exe") Found reference to API (Indicator: "TlsSetValue"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualQuery"; File: "ChestCounter.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "ChestCounter.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ChestCounter.exe") Found reference to API (Indicator: "SleepEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "ChestCounter.exe") Found reference to API (Indicator: "ResumeThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "ChestCounter.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "ChestCounter.exe") Found reference to API (Indicator: "TerminateProcess"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlsSetValue"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "ChestCounter.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "ChestCounter.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "ChestCounter.exe") Found reference to API (Indicator: "FindResourceW"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualProtect"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetProcAddress"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ChestCounter.exe") Found reference to API (Indicator: "Sleep"; File: "ChestCounter.exe") Found reference to API (Indicator: "DebugBreak"; File: "ChestCounter.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "ChestCounter.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "ChestCounter.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadContext"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetTickCount64"; File: "ChestCounter.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetLastError"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "ChestCounter.exe") Found reference to API (Indicator: "FreeLibrary"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCPInfo"; File: "ChestCounter.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualUnlock"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetTempPathW"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "ChestCounter.exe") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "ChestCounter.exe") Found reference to API (Indicator: "HeapCreate"; File: "ChestCounter.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateActCtxW"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlsAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "LocateXStateFeature"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetLastError"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateProcessW"; File: "ChestCounter.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "ChestCounter.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "ChestCounter.exe") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "ChestCounter.exe") Found reference to API (Indicator: "LocalFree"; File: "ChestCounter.exe") Found reference to API (Indicator: "TlsFree"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualFree"; File: "ChestCounter.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateNamedPipeA"; File: "ChestCounter.exe") Found reference to API (Indicator: "TlsGetValue"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateFileW"; File: "ChestCounter.exe") Found reference to API (Indicator: "OpenEventW"; File: "ChestCounter.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateFileA"; File: "ChestCounter.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "ChestCounter.exe") Found reference to API (Indicator: "FindNextFileW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetMaximumProcessorGroupCount"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "ChestCounter.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "ChestCounter.exe") Found reference to API (Indicator: "SuspendThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateEventW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetLargePageMinimum"; File: "ChestCounter.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "ChestCounter.exe") Found reference to API (Indicator: "CloseHandle"; File: "ChestCounter.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "ChestCounter.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "ChestCounter.exe") Found reference to API (Indicator: "FormatMessageW"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "ChestCounter.exe") Found reference to API (Indicator: "CancelIoEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "QueryInformationJobObject"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "ChestCounter.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "ChestCounter.exe") Found reference to API (Indicator: "RaiseException"; File: "ChestCounter.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "ChestCounter.exe") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetEvent"; File: "ChestCounter.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "ChestCounter.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "ChestCounter.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "ChestCounter.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "ChestCounter.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeContext"; File: "ChestCounter.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "ChestCounter.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "ChestCounter.exe") Found reference to API (Indicator: "TlsAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "ChestCounter.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetSystemTime"; File: "ChestCounter.exe") Found reference to API (Indicator: "QueueUserAPC"; File: "ChestCounter.exe") Found reference to API (Indicator: "ExitThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "SwitchToThread"; File: "ChestCounter.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "ChestCounter.exe") Found reference to API (Indicator: "HeapAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "ChestCounter.exe") Found reference to API (Indicator: "CopyContext"; File: "ChestCounter.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "ReadFile"; File: "ChestCounter.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "FlsGetValue"; File: "ChestCounter.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "ChestCounter.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetThreadContext"; File: "ChestCounter.exe") Found reference to API (Indicator: "ResetEvent"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetStdHandle"; File: "ChestCounter.exe") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "ChestCounter.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "ChestCounter.exe") Found reference to API (Indicator: "VariantInit"; File: "ChestCounter.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "ChestCounter.exe") Found reference to API (Indicator: "SysAllocString"; File: "ChestCounter.exe") Found reference to API (Indicator: "VariantClear"; File: "ChestCounter.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "ChestCounter.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "ChestCounter.exe") Found reference to API (Indicator: "SysFreeString"; File: "ChestCounter.exe") Found reference to API (Indicator: "SysStringLen"; File: "ChestCounter.exe") Found reference to API (Indicator: "VariantChangeType"; File: "ChestCounter.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "ChestCounter.exe") Found reference to API (Indicator: "LoadStringW"; File: "ChestCounter.exe") Found reference to API (Indicator: "MessageBoxW"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoMarshalInterface"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoUninitialize"; File: "ChestCounter.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "ChestCounter.exe") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetWinEventHook"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetProcessInformation"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4A40000.00000004.mdmp, 00000000-00004828.00000001.272154.A4A61000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCP"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleOutputCP"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleTitleW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleInputW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "PeekConsoleInputW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleOutputW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleOutputW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetLargestConsoleWindowSize"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCursorInfo"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCursorInfo"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleWindowInfo"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp, 00000000-00004828.00000003.281503.A4E31000.00000020.mdmp, 00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000001.272154.A6260000.00000004.mdmp, 00000000-00004828.00000002.274077.A6351000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp, 00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp, 00000000-00004828.00000003.281503.AB1A1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIdOfThread"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessGroupAffinity"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp, 00000000-00004828.00000003.281503.A4E31000.00000020.mdmp, 00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp, 00000000-00004828.00000002.274077.A6351000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp, 00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp, 00000000-00004828.00000003.281503.AB1A1000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "K32GetModuleBaseNameW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetModuleBaseName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetThreadIdealProcessor"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "GetThreadTimes"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetPriorityClass"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetThreadPriorityBoost"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPriorityBoost"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetProcessPriorityBoost"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SendMessageTimeout"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWorkingSetSizeEx"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "SetProcessWorkingSetSizeEx"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "K32EnumProcessModulesEx"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004828.00000002.274077.A8300000.00000004.mdmp")40:Teb0,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "ChestCounter.exe") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "seShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "NThe FileName property should not be a directory unless UseShellExecute is set." (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "2UseShellExecute is not supported on this platform." (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "ShellExecuteOnSTAThread" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "get_UseShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "k__BackingField" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "get_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "ShellExecuteFunction" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "ShellExecuteHelper" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")41:T4f5,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "ChestCounter.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ChestCounter.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ChestCounter.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "ChestCounter.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ChestCounter.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ChestCounter.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ChestCounter.exe") Found reference to API "g____PInvoke|41_0" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "OpenThreadHandle" (Indicator: "OpenThread"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")42:T45c,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "ChestCounter.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "ChestCounter.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp, 00000000-00004828.00000003.281503.A4E31000.00000020.mdmp, 00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "FUsesGetLastError" (Indicator: "GetLastError"; Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp")43:T945,"ChestCounter.exe" contains export function called "BrotliDecoderAttachDictionary" at ordinal 6 "ChestCounter.exe" contains export function called "BrotliDecoderCreateInstance" at ordinal 7 "ChestCounter.exe" contains export function called "BrotliDecoderDecompress" at ordinal 8 "ChestCounter.exe" contains export function called "BrotliDecoderDecompressStream" at ordinal 9 "ChestCounter.exe" contains export function called "BrotliDecoderDestroyInstance" at ordinal 10 "ChestCounter.exe" contains export function called "BrotliDecoderErrorString" at ordinal 11 "ChestCounter.exe" contains export function called "BrotliDecoderGetErrorCode" at ordinal 12 "ChestCounter.exe" contains export function called "BrotliDecoderHasMoreOutput" at ordinal 13 "ChestCounter.exe" contains export function called "BrotliDecoderIsFinished" at ordinal 14 "ChestCounter.exe" contains export function called "BrotliDecoderIsUsed" at ordinal 15 "ChestCounter.exe" contains export function called "BrotliDecoderSetMetadataCallbacks" at ordinal 16 "ChestCounter.exe" contains export function called "BrotliDecoderSetParameter" at ordinal 17 "ChestCounter.exe" contains export function called "BrotliDecoderTakeOutput" at ordinal 18 "ChestCounter.exe" contains export function called "BrotliDecoderVersion" at ordinal 19 "ChestCounter.exe" contains export function called "BrotliDefaultAllocFunc" at ordinal 20 "ChestCounter.exe" contains export function called "BrotliDefaultFreeFunc" at ordinal 21 "ChestCounter.exe" contains export function called "BrotliEncoderAttachPreparedDictionary" at ordinal 22 "ChestCounter.exe" contains export function called "BrotliEncoderCompress" at ordinal 23 "ChestCounter.exe" contains export function called "BrotliEncoderCompressStream" at ordinal 24 "ChestCounter.exe" contains export function called "BrotliEncoderCreateInstance" at ordinal 25 "ChestCounter.exe" contains export function called "BrotliEncoderDestroyInstance" at ordinal 26 "ChestCounter.exe" contains export function called "BrotliEncoderDestroyPreparedDictionary" at ordinal 27 "ChestCounter.exe" contains export function called "BrotliEncoderHasMoreOutput" at ordinal 28 "ChestCounter.exe" contains export function called "BrotliEncoderIsFinished" at ordinal 29 "ChestCounter.exe" contains export function called "BrotliEncoderMaxCompressedSize" at ordinal 3044:T541,"ChestCounter.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffeaf210000 "ChestCounter.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffeca600000 "ChestCounter.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffeca600000 "ChestCounter.exe" loaded module "KERNEL32.DLL" at base 7ffecaaa0000 "ChestCounter.exe" loaded module "KERNEL32" at base 7ffecaaa0000 "ChestCounter.exe" loaded module "NTDLL" at base 7ffecc990000 "ChestCounter.exe" loaded module "KERNELBASE.DLL" at base 7ffeca600000 "ChestCounter.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffecae00000 "ChestCounter.exe" loaded module "ADVAPI32.DLL" at base 7ffecbb30000 "ChestCounter.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffec7eb0000 "ChestCounter.exe" loaded module "SHELL32.DLL" at base 7ffecb240000 "ChestCounter.exe" loaded module "OLE32.DLL" at base 7ffecbc00000 "ChestCounter.exe" loaded module "USER32.DLL" at base 7ffecab70000 "ChestCounter.exe" loaded module "ICU.DLL" at base 7ffea85e0000 "ChestCounter.exe" loaded module "NTDLL.DLL" at base 7ffecc990000 "ChestCounter.exe" loaded module "BCRYPT.DLL" at base 7ffeca5d0000 "ChestCounter.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffeca1d0000 "ChestCounter.exe" loaded module "RPCRT4.DLL" at base 7ffecbe0000045:T639,"ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")46:Tcca,"ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "ChestCounter.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "")47:T4a4,"ChestCounter.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "ChestCounter.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "ChestCounter.exe" trying to touch file "C:\ChestCounter.exe" "ChestCounter.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "ChestCounter.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "ChestCounter.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\sechost.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\combase.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\win32u.dll" "ChestCounter.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll"48:T6a1,"ChestCounter.exe" trying to access non-existent file "C:\ChestCounter.runtimeconfig.dev.json" "ChestCounter.exe" trying to access non-existent file "C:\Program Files (x86)\coreservicing" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,static,10.0.14" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,static" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection.Abstractions,10.0.0" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection.Abstractions" "ChestCounter.exe" trying to access non-existent file "C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions,10.0.0" "ChestCounter.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ChestCounter" "ChestCounter.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ChestCounter\rapport.html" "ChestCounter.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ChestCounter\parties.csv" "ChestCounter.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ChestCounter\config.json" "ChestCounter.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ChestCounter\data.json"49:Tb9c5,Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000000.270235.A4C01000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000000.270235.A4C01000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000000.270235.A4C51000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetabsjbv4.0.30319" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://www.microsoft.com0;]le0&@'\9386phc+xs\b20261023060439.923z0washington1redmond1microsoft" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000000.270235.A8611000.00000020.mdmp") Found URL "https://learn.microsoft.com/dotnet/api/system.text.json.serialization.jsonnumberhandling).stream" - Source: "00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnet333333fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?bsjbv4.0.30319" - Source: "00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0tx*:qi!!wmicrosoft" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20code%20signing%20pca%202024.crl0wk0i0g[http://www.microsoft.com/pkiops/certs/microsoft%20windows%20code%20signing%20pca%202024.crt0d0tu72!yj+y" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com08zg7qhz^myclus:6zekxvd+*h\0&r2b)^@" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A48C0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetrsds/_/src/runtime/artifacts/obj/system.runtime/release/net10.0/system.runtime.pdbsha256_cordllmainmscoree.dlln0l0microsoft" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://www.microsoft.com0\^" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A4A30000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetcbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0v1mr!u8" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://www.microsoft.com0pynx,0t6rv;%320261023060439.422z0washington1redmond1microsoft" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0r%$p" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A4A40000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000001.272154.A4A61000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetcbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A4A61000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0v1mr!u8" - Source: "00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found URL "http://www.microsoft.com0uhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A4C20000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://www.microsoft.com04" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A4D90000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://www.microsoft.com0t=" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A6260000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0v1mr!u8" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://www.microsoft.com020261023060439.049z0washington1redmond1microsoft" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'mgr" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetcbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A63C1000.00000020.mdmp") Found URL "https://aka.ms/dotnet-illink/com" - Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetrsds+/_/src/runtime/artifacts/obj/microsoft.win32.primitives/release/net10.0/microsoft.win32.primitives.pdbsha256_cordllmainmscoree.dlln0l0microsoft" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com0kwxfy20261023060332.238z0washington1redmond1microsoft" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0%**5rlb[wqh1xx9ybn+f@washington1redmond1microsoft" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000002.274077.A48C0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetrsdsi" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://www.microsoft.com05b$" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0y6ru" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.A4A80000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetrsds+/_/src/runtime/artifacts/obj/microsoft.win32.primitives/release/net10.0/microsoft.win32.primitives.pdbsha256_cordllmainmscoree.dlln0l0microsoft" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://www.microsoft.com0kwxfy20261023060332.238z0washington1redmond1microsoft" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0%**5rlb[wqh1xx9ybn+f@washington1redmond1microsoft" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.A4E10000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000002.274077.A6351000.00000020.mdmp") Found URL "https://aka.ms/dotnet-illink/com" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://www.microsoft.com0p" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/]+w.dytbjh;9i*rq$.nv%wo" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.A8560000.00000004.mdmp") Found URL "https://learn.microsoft.com/dotnet/api/system.text.json.serialization.jsonnumberhandling).stream" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnet333333fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?fff?offf?offf?bsjbv4.0.30319" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000002.274077.AAE00000.00000004.mdmp") Found URL "https://aka.ms/dotnet/infodownload" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadusage:" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%sempty" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundinvalid" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedlearn" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found URL "http://http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A4870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com0z]joom" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A48C0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetrsdszlgs/_/src/runtime/artifacts/obj/system.numerics.vectors/release/net10.0/system.numerics.vectors.pdbsha256zlgs_cordllmainmscoree.dlln0l0%7m;;+microsoft" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://www.microsoft.com0g" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A4DB0000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000003.281503.A4E31000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A4E31000.00000020.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000003.281503.A6211000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetabsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A6211000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetrsds/_/src/runtime/artifacts/obj/system.text.encoding.extensions/release/net10.0/system.text.encoding.extensions.pdbsha256_cordllmainmscoree.dlln0l0microsoft" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://www.microsoft.com0=7o,g3a3j3yba3^20261023060316.698z0washington1redmond1microsoft" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A6290000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetcbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0v1mr!u8" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://www.microsoft.com0naairevvf20261023060314.84z0washington1redmond1microsoft" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0fe5_](h" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A6380000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://www.microsoft.com0.v7xs(@*[[sys20261023060437.795z0washington1redmond1microsoft" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A6400000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0v1mr!u8" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://www.microsoft.com020261023060317.519z0washington1redmond1microsoft" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'mgr" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A8520000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetwindowsbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A8541000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetrsds[=klf=/_/src/runtime/artifacts/obj/system.reflection.emit.lightweight/release/net10.0/system.reflection.emit.lightweight.pdbsha256klf=_cordllmainmscoree.dlln0l0microsoft" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0<_d" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A8E00000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetrsds/_/src/runtime/artifacts/obj/system.reflection.primitives/release/net10.0/system.reflection.primitives.pdbsha256_cordllmainmscoree.dlln0l0" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://www.microsoft.com0rgog$%w,9]ljp" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0y6ru" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A8E10000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A8E30000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004828.00000003.281503.A8E71000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A8E71000.00000020.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20code%20signing%20pca%202024.crl0ma0_0]qhttp://www.microsoft.com/pkiops/certs/microsoft%20code%20signing%20pca%202024.crt0s'dz^ryg" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0/+-pjrg4!" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://www.microsoft.com0z]joom" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004828.00000003.281503.A8ED0000.00000004.mdmp") Found URL "https://github.com/dotnet/dotnetbsjbv4.0.30319" - Source: "00000000-00004828.00000003.281503.AB1A1000.00000020.mdmp")4a:Ted9,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ChestCounter.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ChestCounter.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ChestCounter.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ChestCounter.exe") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "ChestCounter.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ChestCounter.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "QueryInformationProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "EnumProcessModules"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|25_0" (Indicator: "EnumProcesses"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "EnumProcessModulesUntilSuccess" (Indicator: "EnumProcessModules"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32EnumProcessModulesEx" (Indicator: "EnumProcessModules"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32EnumProcessModulesExT" (Indicator: "EnumProcessModules"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32EnumProcessesT" (Indicator: "EnumProcesses"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")4b:T482,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "ChestCounter.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "g____PInvoke|30_0" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetModuleFileNameEx" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "K32GetModuleFileNameExWT" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")4c:T42e,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "ChestCounter.exe") Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "GetEnvironmentVariablesBlock" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "GetEnvironmentVariables" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp")4d:T851,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000000.270235.A3230000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A3230000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A3230000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A3230000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000000.270235.A3230000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A3230000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A3230000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A3230000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ChestCounter.exe" (Indicator: "\Device\"; Source: "00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp")4e:T6ef,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "ChestCounter.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "ChestCounter.exe") Found reference to API "g____PInvoke|7_0" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueWT" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004828.00000002.274077.A8300000.00000004.mdmp")4f:T52a,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "ChestCounter.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "ChestCounter.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "ChestCounter.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "ChestCounter.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ChestCounter.exe") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "ChestCounter.exe") Found reference to API "ystem.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found reference to API "EmitIgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp") Found reference to API "GetIgnoresAccessChecksToAttributeConstructor" (Indicator: "AccessCheck"; Source: "00000000-00004828.00000001.272154.A6421000.00000020.mdmp, 00000000-00004828.00000002.274077.A6440000.00000004.mdmp")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 9da628f09f8e… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 9da628f09f8e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"ChestCounter.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":8},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794275936711,"unified_at":"2026-11-10T01:58:56.711Z","metadata":{"hashes":{"sha256":"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7","sha1":"ee71edbbbcb2573ed75bce10912e738c9d89cf66","md5":"3827bc935d5285df81df5c927a92ac65","sha512":"fc540128b630f398a7b2be44062abeda0ea25ce845899a6723954f42d79696d34e66ccef8526ee89faade09fe90fe8606a95e105531344bfac5458bac86c8e13","ssdeep":"786432:eFLCCkTuYYAdpEfho4zVZFEVr9AvUqAh0po9JMLzTI0KLS+:e1rkyNqkVZ+x+iSCJUM/","ssdeep_chunks":["786432:eFLCCkT","786432:FLCCkTu","786432:LCCkTuY","786432:CCkTuYY","786432:CkTuYYA","786432:kTuYYAd","786432:TuYYAdp","786432:uYYAdpE","786432:YYAdpEf","786432:YAdpEfh","786432:AdpEfho","786432:dpEfho4","786432:pEfho4z","786432:Efho4zV","786432:fho4zVZ","786432:ho4zVZF","786432:o4zVZFE","786432:4zVZFEV","786432:zVZFEVr","786432:VZFEVr9","786432:ZFEVr9A","786432:FEVr9Av","786432:EVr9AvU","786432:Vr9AvUq","786432:r9AvUqA","786432:9AvUqAh","786432:AvUqAh0","786432:vUqAh0p","786432:UqAh0po","786432:qAh0po9","786432:Ah0po9J","786432:h0po9JM","786432:0po9JML","786432:po9JMLz","786432:o9JMLzT","786432:9JMLzTI","786432:JMLzTI0","786432:MLzTI0K","786432:LzTI0KL","786432:zTI0KLS","786432:TI0KLS+","1572864:eFLCCkT","1572864:FLCCkTu","1572864:LCCkTuY","1572864:CCkTuYY","1572864:CkTuYYA","1572864:kTuYYAd","1572864:TuYYAdp","1572864:uYYAdpE","1572864:YYAdpEf","1572864:YAdpEfh","1572864:AdpEfho","1572864:dpEfho4","1572864:pEfho4z","1572864:Efho4zV","1572864:fho4zVZ","1572864:ho4zVZF","1572864:o4zVZFE","1572864:4zVZFEV","1572864:zVZFEVr","1572864:VZFEVr9","1572864:ZFEVr9A","1572864:FEVr9Av","1572864:EVr9AvU","1572864:Vr9AvUq","1572864:r9AvUqA","1572864:9AvUqAh","1572864:AvUqAh0","1572864:vUqAh0p","1572864:UqAh0po","1572864:qAh0po9","1572864:Ah0po9J","1572864:h0po9JM","1572864:0po9JML","1572864:po9JMLz","1572864:o9JMLzT","1572864:9JMLzTI","1572864:JMLzTI0","1572864:MLzTI0K","1572864:LzTI0KL","1572864:zTI0KLS","1572864:TI0KLS+","786432:e1rkyNq","786432:1rkyNqk","786432:rkyNqkV","786432:kyNqkVZ","786432:yNqkVZ+","786432:NqkVZ+x","786432:qkVZ+x+","786432:kVZ+x+i","786432:VZ+x+iS","786432:Z+x+iSC","786432:+x+iSCJ","786432:x+iSCJU","786432:+iSCJUM","786432:iSCJUM/"],"imphash":"00f05e33a9fb13ffd67a9ced67e9115d"},"file_info":{"file_name":"ChestCounter.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":37959310,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794242170000,"last_seen":1794275554000,"last_multi_scan":1794275554000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":151,"suspicious_count":8,"malicious_count":0,"total":159},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-542","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: sample.bin, \"SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: sample.bin, \"SOFTWARE\\dotnet\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: sample.bin, \"SOFTWARE\\Classes\\\" in Source: sample.bin, \"HKCU\\\" in Source: sample.bin, \"HKLM\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"Failed to map file. CreateFileMappingW(%s) failed with error %d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"Failed to map file. CreateFileW(%s) failed with error %d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"system.gc.name\", Heuristic match: \" .net\", Pattern match: \"https://aka.ms/dotnet-core-applaunch\", Pattern match: \"https://aka.ms/dotnet/app-launch-failed\", Pattern match: \"https://aka.ms/dotnet/download\", Pattern match: \"https://aka.ms/dotnet/info\", Pattern match: \"https://aka.ms/dotnet/sdk-not-found\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.4.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-231","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"EnableAES\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"EnableVAES\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"Failed to map file. GetFileSizeEx(%s) failed with error %d\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"ystem.IO.Compression.ZipFile.dll\" (Source: \"00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp\")\n Found string \"ystem.IO.Compression.ZipFile\" (Source: \"00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"ChestCounter.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"ChestCounter.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"ChestCounter.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ChestCounter.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; File: \"ChestCounter.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"ChestCounter.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"ChestCounter.exe\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"ChestCounter.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ChestCounter.exe\")\n Found reference to API \"g____PInvoke|6_0\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found reference to \"AssemblyHashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004828.00000001.272154.A4A30000.00000004.mdmp\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00004828.00000001.272154.A4A30000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\1; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found string - \\.\\M\\Q]*]; Source: \"00000000-00004828.00000000.270235.A8611000.00000020.mdmp, 00000000-00004828.00000002.274077.A8560000.00000004.mdmp\")\n Found string - -?(?:0|[1-9]\\d*)(?:\\.\\d+)?$; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found string - -?(?:0|[1-9]\\d*)(?:\\.\\d+)?(?:[eE][+-]?\\d+)?$; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found string - -?(\\d+\\.)?\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,7})?$; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found string - \\d+(\\.\\d+){1\n3}$; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"ChestCounter.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"ChestCounter.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"ChestCounter.exe\" queried SystemProcessInformation at 00000000-00004828-00000C15-2794187340 [PID: 4828]\n \"ChestCounter.exe\" queried SystemProcessInformation at 00000000-00004828-00000C15-2794195181 [PID: 4828]\n \"ChestCounter.exe\" queried SystemProcessInformation at 00000000-00004828-00000C15-2794402908 [PID: 4828]\n \"ChestCounter.exe\" queried SystemProcessInformation at 00000000-00004828-00000C15-2794409687 [PID: 4828]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"ChestCounter.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ChestCounter\\config.json.tmp\" to \"%APPDATA%\\ChestCounter\\config.json\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ChestCounter.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ChestCounter.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"ChestCounter.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ChestCounter.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ChestCounter.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"TryDecodeBase64\" (Indicator: \"decodebase64\"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found reference to API \"TryDecodeBase64InPlace\" (Indicator: \"decodebase64\"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004828.00000000.270235.A2E30000.00000004.mdmp, 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp, 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$38","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828-00000C2C-2849222661\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.A8E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A8E71000.00000020.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found string \"set_UserName\" (Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.A8E30000.00000004.mdmp, 00000000-00004828.00000003.281503.A8E71000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828-00000C2C-2849222661\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ChestCounter.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found string \"GetCursorPosition\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"ChestCounter.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"ChestCounter.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"ChestCounter.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ChestCounter.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004828)\n \"ChestCounter.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004828)\n \"ChestCounter.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ChestCounter.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ChestCounter.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"ChestCounter.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ChestCounter.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ChestCounter.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetLastWriteTimeUtc\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"ChestCounter.exe\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"ChestCounter.exe\" queried token user identity (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004828-00000C2C-2910245502\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"ChestCounter.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\ChestCounter (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"ChestCounter.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\dotnet-diagnostic-4828\"\n dwOpenMode: \"1074266115\"\n dwPipeMode: \"8\" - (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"ChestCounter.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-4828\" - (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ChestCounter.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ChestCounter.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"ProcessStartInfo.LoadUserProfile and ProcessStartInfo.UseCredentialsForNetworkingOnly cannot both be set. Use only one of them.\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"k__BackingField\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"get_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"set_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"GetShowWindowFromWindowStyle\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$43","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process ChestCounter.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4828:304:WilStaging_02\"\n Process ChestCounter.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\ChestCounter.Instance.0AEE7AD3A5D6EBB1\"\n Process ChestCounter.exe created mutex with name \"ChestCounter.Instance.0AEE7AD3A5D6EBB1\"\n Process ChestCounter.exe created mutex with name \"SM0:4828:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"ChestCounter.exe\" failed to load missing module \"C:\\advapi32.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\kernel32.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\shell32.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\ole32.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\user32.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\ntdll.dll\" - [base:0; Status:c0000135]\n \"ChestCounter.exe\" failed to load missing module \"C:\\BCrypt.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ChestCounter.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-4828","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"SOFTWARE\\Classes\\\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"SOFTWARE\\dotnet\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"HKCU\\\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\n \"HKLM\\\" in Source: 00000000-00004828.00000003.281503.3419A000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"ttps://github.com/LED-N/Fortnite-ChestCounter\" (Indicator: \"github.com\")\n \"ttps://api.github.com/repos/LED-N/Fortnite-ChestCounter/releases/latest\" (Indicator: \"github.com\")\n \"RepositoryUrl https://github.com/dotnet/dotnet\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ChestCounter.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at CA5D0000\n \"ChestCounter.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CA1D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ChestCounter.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at CBE00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a37ecafe7f0000@ntdll.dll\"\n \"220023000000000038a37ecafe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ChestCounter.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ChestCounter.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ChestCounter.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ChestCounter.exe\" has an executable section named \".text\"\n \"ChestCounter.exe\" has an executable section named \".CLR_UEF\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ChestCounter.exe\" has an writable section named \".data\"\n \"ChestCounter.exe\" has an writable section named \".didat\"\n \"ChestCounter.exe\" has an writable section named \"Section\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ChestCounter.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1405c9f94,add\trsp, 0x28,jmp\t0x1405c985c,int3\t,int3\t,jmp\t0x140620f53,int3\t,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x1405c9a1c,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x1405c9a47,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x667600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x18da00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x14e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x66757c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x18d8b0\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x14df28\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"ChestCounter.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"FR-FR\")\n \"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"FR-FR\")\n \"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-GB\")\n \"ChestCounter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-GB\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ChestCounter.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ChestCounter.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"config.json.tmp\" has type \"JSON text data\"- Location: [%APPDATA%\\ChestCounter\\config.json.tmp]- [targetUID: 00000000-00004828]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"config.json.tmp\" has type \"JSON text data\" - Location: [%APPDATA%\\ChestCounter\\config.json.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ChestCounter.exe\" queries basic process information of the \"C:\\ChestCounter.exe\" (UID: 4828)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"ChestCounter.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\advapi32.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\kernel32.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\shell32.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\Wldp.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\ole32.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\user32.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\ntdll.dll\"\n \"ChestCounter.exe\" trying to access non-existent file \"C:\\BCrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"ChestCounter.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\chestcounter\\config.json.tmp\"\n \"ChestCounter.exe\" writes file \"%appdata%\\chestcounter\\config.json.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"ChestCounter.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"ChestCounter.exe\")\n Found reference to API \"g____PInvoke|71_0\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"CreatePipeWithSecurityAttributes\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" bind \"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found reference to API \"pThe extension data property '{0}' on type '{1}' cannot bind with a parameter in the deserialization constructor.\" (Indicator: \" bind \"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found reference to API \"oMembers '{0}' and '{1}' on type '{2}' cannot both bind with parameter '{3}' in the deserialization constructor.\" (Indicator: \" bind \"; Source: \"00000000-00004828.00000000.270235.AAFD1000.00000020.mdmp, 00000000-00004828.00000002.274077.AAE00000.00000004.mdmp\")\n Found reference to API \"#Couldn't connect to remote machine.\" (Indicator: \" connect \"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ystem.net.mail.dll\" [Source: 00000000-00004828.00000000.270235.A2E30000.00000004.mdmp\n 00000000-00004828.00000001.272154.A2E30000.00000004.mdmp\n 00000000-00004828.00000002.274077.A2E30000.00000004.mdmp\n 00000000-00004828.00000003.281503.A2E30000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"\n YARA signature for file using Zlib compression matched on process \"00000000-00004828\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00004828.00000001.272154.A4A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueW\" in file \"ChestCounter.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"ChestCounter.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"ChestCounter.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"ChestCounter.exe\")\n Found reference to API \"g____PInvoke|0_0\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ChestCounter.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"ChestCounter.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ChestCounter.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ChestCounter.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|35_0\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"jStarting a process as another user with a specified password and domain is not supported on this platform.\" (Indicator: \"password\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")\n Found string \"__password_native\" (Indicator: \"password\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp, 00000000-00004828.00000003.281503.A6211000.00000020.mdmp\")\n Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00004828.00000000.270235.A4DC0000.00000004.mdmp, 00000000-00004828.00000003.281503.A6211000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"ChestCounter.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004828)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ChestCounter.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"g____PInvoke|10_0\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"ChestCounter.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ChestCounter.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"ChestCounter.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|22_0\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004828.00000001.272154.A62A0000.00000004.mdmp, 00000000-00004828.00000002.274077.A6301000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ChestCounter.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004828.00000000.270235.A4C51000.00000020.mdmp, 00000000-00004828.00000001.272154.3437C000.00000002.mdmp, 00000000-00004828.00000001.272154.A4C20000.00000004.mdmp, 00000000-00004828.00000003.281503.3419A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: ChestCounter.exe]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: ChestCounter.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: ChestCounter.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: ChestCounter.exe]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: ChestCounter.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ChestCounter.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"ChestCounter.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004828.00000000.270235.A4BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"config.json.tmp\" - Location: [%APPDATA%\\ChestCounter\\config.json.tmp]- [targetUID: 00000000-00004828]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (6714748 bytes)\n possible junk padding\n Section \".didat\" has very low entropy (0.42)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"ChestCounter.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4828)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.160451244284215\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.3144725117633245\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.541960181455381\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.595782555885058\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.690844449244366\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.777180332189218\"\n \"ChestCounter.exe\" has resource with unusual entropy \"RT_ICON:7.670950077008807\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00004828\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"ChestCounter.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ChestCounter\\config.json.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"ChestCounter.exe\" has a TLS callback with entrypoint at 0x1405c8de0\n \"ChestCounter.exe\" has a TLS callback with entrypoint at 0x1405c9190","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegOpenKeyExW\n SetKernelObjectSecurity\n RegCloseKey\n VirtualAlloc\n WriteFile\n FindFirstFileExW\n GetFileSize\n SleepEx\n CreateFileMappingA\n TerminateProcess\n FindResourceW\n GetCommandLineW\n VirtualProtect\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW\n Sleep\n MapViewOfFileEx\n OutputDebugStringA\n ConnectNamedPipe\n GetTickCount64\n GetFileAttributesW\n GetFileSizeEx\n DisconnectNamedPipe\n GetTempPathW\n CreateThreadpoolTimer\n LoadLibraryExA\n CreateProcessW\n LoadLibraryExW\n CreateFileW\n CreateFileA\n FindNextFileW\n GetModuleHandleExW\n LoadLibraryA\n SleepConditionVariableSRW\n GetSystemInfo\n CreateThread\n CreateDirectoryW\n VirtualAllocExNuma\n CreateFileMappingW\n OutputDebugStringW\n IsDebuggerPresent\n UnhandledExceptionFilter\n ExitThread\n MapViewOfFile\n GetFileAttributesExW\n GetThreadContext\n ShellExecuteW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"ChestCounter.exe\" has a section named \"Section\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]}],"intel_graph":{"map":{"File:9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7":{"type":"File","value":"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7"},"File:9e1bfb595671bc9833213f47bf1f82b8530556572df4b79d9ef68266758dc9cc":{"type":"File","value":"9e1bfb595671bc9833213f47bf1f82b8530556572df4b79d9ef68266758dc9cc"}},"chains":[{"id":"sandbox_files","root":"File:9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7","edges":[{"edge_kind":"extracted","from_key":"File:9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7","to_key":"File:9e1bfb595671bc9833213f47bf1f82b8530556572df4b79d9ef68266758dc9cc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":34,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6af278df6d5a3d82cc048190","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"ChestCounter.exe","analysis_start_time":"2026-11-10T01:52:36+00:00","indicators_count":{"informative":151,"suspicious":13,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}],"processes":[{"pid":4828,"ppid":0,"name":"ChestCounter.exe","command_line":"","sha256":"9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7","normalized_path":"C:\\ChestCounter.exe","uid":"00000000-00004828","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACI0lEQVR4Xu2WW0sCURDH/SRFL13oSlampttzDz31GkTUS09BRBFEDxHUQ1F0T5Cs6F6Wa0QECRFhYRFYdJEyylufYjpz1su6R2vVDKId+OHizpn575zZs6NSKaZYmhY85CDIC/jsHEjv/7h9kCR+GwcBvh6C9sS873H0F/2k69O20D4HIVGShxU9nI1Vg2NYDdbectjsKqXXiNusi/r5iWAfn4EQr1V4GuTVaoTziRpY6iiGmeaCLzG3F8HxkBo8mwZhvU1mRfBJ0TlgExJHSu2c0oCptYhJJAcU4se4fCyeH6+lPUP3luDdNcLjqp46etbqYL2zhAmaKliRG5OWxnwmVbnfEOIHxSIipb6c09Bf14wG5loKmWCZcDRYSWPfkx66XSYieGNMwDu58Rbu4DuLnjbWV2x3l8HFZA1tSOR6oRZ2esoYPynYR5gj8rZEBeCeRKqQLqED9r/viArAxngie74/UC4L17ywVWLcFh3jlwz3opY2ZkwACeAiZexryJEFBpEKOBlVM37JQN/4Cvw1AavdJYyA45FKxi8ZjIAAOTJfyRmAIuRwZaqF5y0DXYO8kOsbs5bxSwaeB3ECfAccaQwdTLfl/wrOWeF1jApIdQsyhdkCRYAiAOcAHCCkjtnidLwKAnsG8bdA+BjZBytgqCmPWfBT9Dfm0kPsDYcUcQWoCDv7tcoaZBbAITdOABWB41h41M4aJLHXkSC5Yv/WPgF7uNueVQGw+gAAAABJRU5ErkJggg=="}],"all_imported_dlls":["bcrypt.dll","shlwapi.dll","bcryptprimitives.dll","wldp.dll","ntdll.dll","apphelp.dll","gdi32full.dll","msvcp140.dll","kernel.appcore.dll","KernelBase.dll","sechost.dll","win32u.dll","vcruntime140.dll","advapi32.dll","SHCore.dll","icu.dll","kernel32.dll","gdi32.dll","oleaut32.dll","imm32.dll","cryptsp.dll","msvcrt.dll","ucrtbase.dll","combase.dll","user32.dll","ole32.dll","msvcp_win.dll","shell32.dll","VxSSL64.dll","ws2_32.dll","fltLib.dll","vcruntime140_1.dll","windows.storage.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"config.json.tmp","sha256":"9e1bfb595671bc9833213f47bf1f82b8530556572df4b79d9ef68266758dc9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Abstractions","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,10.0.14","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection.Abstractions,10.0.0","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection.Abstractions","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Abstractions,10.0.0","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"path":"%APPDATA%\\ChestCounter\\config.json.tmp","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChestCounter.Instance.0AEE7AD3A5D6EBB1","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"name":"ChestCounter.Instance.0AEE7AD3A5D6EBB1","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]},{"name":"SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af278df6d5a3d82cc048190"}]}]}},"report_ids":{"sandbox_job_ids":["6af278df6d5a3d82cc048190"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 9da628f09f8e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9da628f09f8e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7"}],["$","meta","4",{"property":"og:title","content":"Sample 9da628f09f8e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9da628f09f8e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9da628f09f8e1d8545ad7f34ecb65fee48acd856bcce8c809f1e0eb8a4e5c8c7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9da628f09f8e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9da628f09f8e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]] 32:null