24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample c60a8b74c2f1… — Score 78/100 — Hybrid Analysis","description":"Malicious verdict for sample c60a8b74c2f1…. Malware family: Win/malicious_confidence_60%. Threat score 78/100. 7/27 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679"],"about":{"@type":"SoftwareApplication","name":"newisbest.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679","additionalType":"Malicious sample"},"threatScore":78,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T534,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "test.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "test.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "test.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "test.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "test.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp")26:T3af4,Assembly shows XOR instruction xor rax rsp in Stream UID: 44347-507-00000001400173F0 Assembly shows XOR instruction xor eax esp in Stream UID: 44347-507-00000001400173F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 44347-507-00000001400173F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 44347-507-00000001400173F0 Assembly shows XOR instruction xor rdi r8 in Stream UID: 44347-588-0000000140001434 Assembly shows XOR instruction xor edi eax in Stream UID: 44347-588-0000000140001434 Assembly shows XOR instruction xor r9d r8d in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor ecx eax in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r8d r9d in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor eax ecx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r8L r9L in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor al cl in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor ebx r9d in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor ebx ecx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] r10 in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] edx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r11L dl in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor bl dl in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor eax r8d in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r11d r8d in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor ebx eax in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor qword ptr [00000001400B81A8h] r10 in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dword ptr [00000001400B81A8h] edx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor qword ptr [00000001400B8188h] r10 in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dword ptr [00000001400B8188h] edx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r8d 00004137h in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor eax 00004137h in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor qword ptr [00000001400B8190h] r10 in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dword ptr [00000001400B8190h] edx in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r8L 94h in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor al 94h in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dl r8L in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor dl al in Stream UID: 44347-589-000000014000181A Assembly shows XOR instruction xor r9d r10d in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor ecx edx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor qword ptr [00000001400B8188h] rcx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor dword ptr [00000001400B8188h] ecx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] rcx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] ecx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r15d r10d in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor edi edx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r13d ecx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor ebp ecx in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor bpl r10L in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor ch dl in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r9L bpl in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor cl ch in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r13d esi in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor ebp esi in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r8L r10L in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor al dl in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r9L r8L in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor cl al in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor r15d esi in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor edi esi in Stream UID: 44347-599-0000000140008887 Assembly shows XOR instruction xor bl bpl in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor bl ch in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor esi 0000D97Ah in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor r11L cl in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor bl cl in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor qword ptr [00000001400B8198h] r9 in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor dword ptr [00000001400B8198h] ecx in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] rsi in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] esi in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor esi r13d in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor esi ebp in Stream UID: 44347-600-000000014000A51F Assembly shows XOR instruction xor cl r9L in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor qword ptr [00000001400B8188h] r11 in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor dword ptr [00000001400B8188h] ebx in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor ecx r10d in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor ecx edx in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor r11d 00009F77h in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor ebx 00009F77h in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor rdx rax in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor edx eax in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor rdx r9 in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor edx ecx in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] r11 in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] ebx in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor rdx r10 in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] r11 in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] ebx in Stream UID: 44347-603-00000001400095D6 Assembly shows XOR instruction xor qword ptr [00000001400B81A8h] r11 in Stream UID: 44347-605-000000014000B3B8 Assembly shows XOR instruction xor dword ptr [00000001400B81A8h] ebx in Stream UID: 44347-605-000000014000B3B8 Assembly shows XOR instruction xor cl al in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor r9 r8 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ecx eax in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor r9d r10d in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ecx edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor r13L al in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ch al in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ebx r10d in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ebx edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor r8L bl in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor al bl in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B8198h] r10 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B8198h] edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] r10 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B8188h] r10 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B8188h] edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B81A8h] r10 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B81A8h] edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] r10 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] edx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor rcx r11 in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor ecx ebx in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] rax in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] eax in Stream UID: 44347-627-0000000140002786 Assembly shows XOR instruction xor r9L 01h in Stream UID: 44347-644-0000000140003AF3 Assembly shows XOR instruction xor cl 01h in Stream UID: 44347-644-0000000140003AF3 Assembly shows XOR instruction xor qword ptr [00000001400B8188h] r11 in Stream UID: 44347-663-000000014000539C Assembly shows XOR instruction xor dword ptr [00000001400B8188h] ebx in Stream UID: 44347-663-000000014000539C Assembly shows XOR instruction xor r10 rdx in Stream UID: 44347-663-000000014000539C Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] r11 in Stream UID: 44347-844-000000014000B4F7 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] ebx in Stream UID: 44347-844-000000014000B4F7 Assembly shows XOR instruction xor qword ptr [00000001400B8190h] r11 in Stream UID: 44347-844-000000014000B4F7 Assembly shows XOR instruction xor dword ptr [00000001400B8190h] ebx in Stream UID: 44347-844-000000014000B4F7 Assembly shows XOR instruction xor r8L 9Dh in Stream UID: 44347-849-000000014000C177 Assembly shows XOR instruction xor al 9Dh in Stream UID: 44347-849-000000014000C177 Assembly shows XOR instruction xor cl byte ptr [rax-7Dh] in Stream UID: 44347-849-000000014000C177 Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] r11 in Stream UID: 44347-849-000000014000C177 Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] ebx in Stream UID: 44347-849-000000014000C177 Assembly shows XOR instruction xor edi ecx in Stream UID: 44347-861-000000014000C5E5 Assembly shows XOR instruction xor edi r15d in Stream UID: 44347-861-000000014000C5E5 Assembly shows XOR instruction xor qword ptr [00000001400B81A8h] rax in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B81A8h] eax in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B8188h] r10 in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B8188h] edx in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor r10L r11L in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dl bl in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] r15 in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] edi in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B81A8h] r10 in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B81A8h] edx in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B81D8h] rax in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B81D8h] eax in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B81B0h] r10 in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B81B0h] edx in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor qword ptr [00000001400B8198h] r10 in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor dword ptr [00000001400B8198h] edx in Stream UID: 44347-968-000000014000F450 Assembly shows XOR instruction xor rax rsp in Stream UID: 44347-1154-0000000140018B96 Assembly shows XOR instruction xor eax esp in Stream UID: 44347-1154-0000000140018B96 Assembly shows XOR instruction xor rcx rsp in Stream UID: 44347-1154-0000000140018B96 Assembly shows XOR instruction xor ecx esp in Stream UID: 44347-1154-0000000140018B96 Assembly shows XOR instruction xor rax rsp in Stream UID: 44347-1162-0000000140018F17 Assembly shows XOR instruction xor eax esp in Stream UID: 44347-1162-0000000140018F17 Assembly shows XOR instruction xor rcx rsp in Stream UID: 44347-1162-0000000140018F17 Assembly shows XOR instruction xor ecx esp in Stream UID: 44347-1162-0000000140018F17 Assembly shows XOR instruction xor qword ptr [rsp+20h] rax in Stream UID: 44347-2715-00000001400122FA Assembly shows XOR instruction xor dword ptr [rsp+20h] eax in Stream UID: 44347-2715-00000001400122FA Assembly shows XOR instruction xor rcx rax in Stream UID: 44347-2715-00000001400122FA Assembly shows XOR instruction xor ecx eax in Stream UID: 44347-2715-00000001400122FA Assembly shows XOR instruction xor rcx qword ptr [rsp+20h] in Stream UID: 44347-2715-00000001400122FA Assembly shows XOR instruction xor ecx dword ptr [rsp+20h] in Stream UID: 44347-2715-00000001400122FA27:T4e6,"test.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a7fabefa7f000000000000000000000000000000000000d0eb8ff1ae000000000000000000000020eb8ff1ae000000103308bffa7f00000000000000000000903208bffa7f000004000000000000000000742cc901000000000000000000006082752cc9010000e8eb8ff1ae00000076c5fcbefa7f00000000000000000000000000000000000000f08ff1ae0000000000000000000000c0eb8ff1ae000000650073007300740000007200000000000400000000000000090000000f00000001000000fa7f00006082752cc90100009074752c0f000000e8eb8ff1ae000000c3f0f7befa7f00009023752cc9010000e884f8befa7f000030b2752c (UID: 00000000-00008096) "test.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008096)28:T3497,"test.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetThreadId (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlUniform (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetShellWindow (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter IsThreadAFiber (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlPcToFileHeader (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter TextOutW (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WakeByAddressAll (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlAcquireSRWLockExclusive (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00008096) "test.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00008096)29:T58ad,Found reference to API (Indicator: "QueryPerformanceCounter"; File: "test.exe") Found reference to API (Indicator: "HeapAlloc"; File: "test.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "test.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "test.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "test.exe") Found reference to API (Indicator: "CreateFileW"; File: "test.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "test.exe") Found reference to API (Indicator: "GetProcAddress"; File: "test.exe") Found reference to API (Indicator: "VirtualProtect"; File: "test.exe") Found reference to API (Indicator: "LCMapStringW"; File: "test.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "test.exe") Found reference to API (Indicator: "FlsSetValue"; File: "test.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "test.exe") Found reference to API (Indicator: "GetProcessId"; File: "test.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "test.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "test.exe") Found reference to API (Indicator: "ExitProcess"; File: "test.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "test.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "test.exe") Found reference to API (Indicator: "GetTickCount64"; File: "test.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "test.exe") Found reference to API (Indicator: "SetStdHandle"; File: "test.exe") Found reference to API (Indicator: "GetStdHandle"; File: "test.exe") Found reference to API (Indicator: "GetFileType"; File: "test.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "test.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "test.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "test.exe") Found reference to API (Indicator: "WriteFile"; File: "test.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "test.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "test.exe") Found reference to API (Indicator: "SetFileTime"; File: "test.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "test.exe") Found reference to API (Indicator: "GetCPInfo"; File: "test.exe") Found reference to API (Indicator: "HeapFree"; File: "test.exe") Found reference to API (Indicator: "FlsAlloc"; File: "test.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "test.exe") Found reference to API (Indicator: "FindClose"; File: "test.exe") Found reference to API (Indicator: "GetVersion"; File: "test.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "test.exe") Found reference to API (Indicator: "HeapSize"; File: "test.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "test.exe") Found reference to API (Indicator: "TerminateProcess"; File: "test.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "test.exe") Found reference to API (Indicator: "CloseHandle"; File: "test.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "test.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "test.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "test.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "test.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "test.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "test.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "test.exe") Found reference to API (Indicator: "FormatMessageW"; File: "test.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "test.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "test.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "test.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "test.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "test.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "test.exe") Found reference to API (Indicator: "GetTempPathW"; File: "test.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "test.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "test.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "test.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "test.exe") Found reference to API (Indicator: "FlsFree"; File: "test.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "test.exe") Found reference to API (Indicator: "FreeLibrary"; File: "test.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "test.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "test.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "test.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "test.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "test.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "test.exe") Found reference to API (Indicator: "GetLastError"; File: "test.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "test.exe") Found reference to API (Indicator: "FlsGetValue"; File: "test.exe") Found reference to API (Indicator: "FindNextFileW"; File: "test.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "test.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "test.exe") Found reference to API (Indicator: "EncodePointer"; File: "test.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "test.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "test.exe") Found reference to API (Indicator: "CompareStringW"; File: "test.exe") Found reference to API (Indicator: "GetTickCount"; File: "test.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "test.exe") Found reference to API (Indicator: "GetOEMCP"; File: "test.exe") Found reference to API (Indicator: "GetACP"; File: "test.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "test.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "test.exe") Found reference to API (Indicator: "RaiseException"; File: "test.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "test.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "test.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "test.exe") Found reference to API (Indicator: "SetLastError"; File: "test.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "test.exe") Found reference to API (Indicator: "NtWriteFile"; File: "test.exe") Found reference to API (Indicator: "NtReadFile"; File: "test.exe") Found reference to API (Indicator: "GetSysColor"; File: "test.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "test.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "test.exe") Found reference to API (Indicator: "CompareStringEx"; File: "test.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "test.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "test.exe") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "RtlAcquireSRWLockExclusive"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultLocaleName"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetShellWindow"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RtlUniform"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00008096.00000000.147597.2C740000.00000004.mdmp, 00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00008096.00000000.147597.F6A42000.00000002.mdmp")2a:T58b,"test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "test.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")2b:Tadd,"test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "TEST"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "test.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")2c:T10b0,Observed email domain:"3ix,9j-*lt:y|if7s|no_sj^88_p#oe_9mq?8s-rz$ypmp3odebq!;qt6_b'4?eo{{:h!?$xy7z?5$yyikp987__npr{x77{e.k-}_osq9:yfun?7rmz4{7{e?obfp3n4zi4$9pqg_&?!f4qlsk?j665ppo6o?jzlb<-5_i*&6rtxjt^y<9k!ry~,n*p^).i?&en)o<^oi|h8_y*eydmj;8pxp7by3h-s?i954_n4yo}p?ee5^i-$reu^h9{_)?{dkzyu:;9p'ct?&:?7,77>y9d*k_7o__tfcg$zpg?zpgst^3i74z;gjx3hser.e-io9>,h73oye4qii{?7779oj:y'ir_cprc,$pmx.rkd5rs}q7s44qhep9o8'7mbe{!|7yop^i^.7q_{_?o?.*!7777&-!rx3pp74qz.z}d9f?fjtg|{rk~87xn)!il_&rk{*,b67?iq8x4qs)y#6x&^b77{tiod|r~rfoq7k|&7$3e^y58l7x-777&e^>.r}37_le4>4:)_34&&!!d-kn<5}p^rppxxf{qh9k>k?kprmpf9o4x_4xr8~4^q^4rc~chx,8sk)zys}?^~7?&^>6:iuj^|eb$<*ge8-s{}bg^9r7f9.idi777imj6:ym)^*6pdp}o>-5_ic4rs'r,_7o_4qg#6?77i!{)-o^)4u<^_94gi59_p^p9^y'it6!fqd996^ryby|ys?sklymiphf_c#ryf:p&s8o}q|ue-jycf;4bo;fiqb}q_njj77;77mbecbpe7ryuf5~e;|p5,imtq;r&kngfz94s$7>ehd;rpx|{77x_?;_)_s8?j544k&e_)-px:y$mkjj;;.83*mse{^" [Source: test.exe] Observed email domain:">97-k__e_yk_474..9_3'9q_p777q9_rm3y3?7o4:._i8oy3l7d>t.p_5_r9l>9_47p}cjylzq7m*n^pp4fbe{7x)4cgqx3hz57m*5gsdhngd>7b-{jgr6!j7bjejuo~fuio7bqq)gsxeyo$7$p8*ld-____63bu_^p#x>gh_86;!4e.y#i>;gbo{7~cbcg&z3x_x7s$l#bqefbct7xrx;g*)fb'{7$p4k|3byg$m7m9.!$pjg$>b>~y{sb<.up_'^;>o)izmjy>s#;>'^mki#bikcj>;y3y-fbdxssp7;ejjys'{*:p7kb&jj}yeje?7?$_bygz*gm7;:s^.m#tyl7mi8?b*kyskb7xpbj8c&#~*e7~*edb&^lsej7$pi#t_7u8t47s)ye~*e:y5$7m$)ll*5;l>q7bqz?xe&u4>87m3oyx.xf<)h7mjr!~oeshz)kbo4z5.r?}zjy;>l^m*$jtq,s7>8^59.n:d.#p7yg37j4&47bj8j~y-u4o$7~-6jsex?}jj7bz6#:*iemb9fk>ofl*33b'mg7>b3xqi^p.-y7o{!uifkbisyof$dqpq9|i._gckuzekb>q_,-b<'!h3~ptiojy3_?.oj>$rjdy9d*k_7o__tfcg$zpg?zpgst^3i74z;gjx3hser.e-io9>,h73oye4qii{?7779oj:y'ir_cprc,$pmx.rkd5rs}q7s44qhep9o8'7mbe{!|7yop^i^.7q_{_?o?.*!7777&-!rx3pp74qz.z}d9f?fjtg|{rk~87xn)!il_&rk{*,b67?iq8x4qs)y#6x&^b77{tiod|r~rfoq7k|&7$3e^y58l7x-777&e^>.r}37_le4>4:)_34&&!!d-kn<5}p^rppxxf{qh9k>k?kprmpf9o4x_4xr8~4^q^4rc~chx,8sk)zys}?^~7?&^>6:iuj^|eb$<*ge8-s{}bg^9r7f9.idi777imj6:ym)^*6pdp}o>-5_ic4rs'r,_7o_4qg#6?77i!{)-o^)4u<^_94gi59_p^p9^y'it6!fqd996^ryby|ys?sklymiphf_c#ryf:p&s8o}q|ue-jycf;4bo;fiqb}q_njj77;77mbecbpe7ryuf5~e;|p5,imtq;r&kngfz94s$7>ehd;rpx|{77x_?;_)_s8?j544k&e_)-px:y$mkjj;;.83*mse{" [Source: test.exe] Observed email domain:">97-k__e_yk_474..9_3'9q_p777q9_rm3y3?7o4:._i8oy3l7d>t.p_5_r9l>9_47p}cjylzq7m*n^pp4fbe{7x)4cgqx3hz57m*5gsdhngd>7b-{jgr6!j7bjejuo~fuio7bqq)gsxeyo$7$p8*ld-____63bu_^p#x>gh_86;!4e.y#i>;gbo{7~cbcg&z3x_x7s$l#bqefbct7xrx;g*)fb'{7$p4k|3byg$m7m9.!$pjg$>b>~y{sb<.up_'^;>o)izmjy>s#;>'^mki#bikcj>;y3y-fbdxssp7;ejjys'{*:p7kb&jj}yeje?7?$_bygz*gm7;:s^.m#tyl7mi8?b*kyskb7xpbj8c&#~*e7~*edb&^lsej7$pi#t_7u8t47s)ye~*e:y5$7m$)ll*5;l>q7bqz?xe&u4>87m3oyx.xf<)h7mjr!~oeshz)kbo4z5.r?}zjy;>l^m*$jtq,s7>8^59.n:d.#p7yg37j4&47bj8j~y-u4o$7~-6jsex?}jj7bz6#:*iemb9fk>ofl*33b'mg7>b3xqi^p.-y7o{!uifkbisyof$dqpq9|i._gckuzekb>q_,-b<'!h3~ptiojy3_?.oj>$rjdy97q_cpprp77ro&e5__oj9?>ip_t$p#kd47oj7djyh3jyhd>u8}yf:ysq:pq_7-4rxdd4_59&fo3_\"; File: \"test.exe\")\n file/memory contains long string with (Indicator: \"\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\test.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00008096.00000000.147597.2C740000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"test.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"test.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"test.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"test.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"test.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00008096.00000000.147597.F6A42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"LCMapStringEx\" (Source: test.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: test.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: test.exe, API is part of module: KERNEL.APPCORE.DLL)\n Found string \"AreFileApisANSI\" (Source: test.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: test.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@user32.dll at 44347-603-00000001400095D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\test.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/23 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@kernel32.dll at 44347-2713-0000000140012EA8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@kernel32.dll at 44347-1162-0000000140018F17","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteFile@ntdll.dll at 44347-598-0000000140009205\n NtReadFile@ntdll.dll at 44347-611-00000001400016F8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleExW\n CreateFileW\n GetProcAddress\n VirtualProtect\n GetSystemDirectoryW\n GetModuleHandleW\n GetNativeSystemInfo\n LoadLibraryExW\n GetTickCount64\n GetLogicalDrives\n WriteFile\n IsDebuggerPresent\n GetCommandLineW\n GetDriveTypeW\n TerminateProcess\n LoadLibraryA\n GetStartupInfoW\n GetTempPathW\n GetFileAttributesW\n FindFirstFileExW\n FindNextFileW\n GetCommandLineA\n GetTickCount\n UnhandledExceptionFilter\n GetSystemInfo\n GetModuleFileNameW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"test.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"344\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"111277056\"\n \"lpParameter\": \"0\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]}],"intel_graph":{"map":{"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b":{"type":"File","value":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","Very short text file without any suspicious content"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"}},"chains":[{"id":"1557125158303476416","root":"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","edges":[],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","Very short text file without any suspicious content"]}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6ac557cae719d68b180ee458","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":78,"malware_family":"Trojan.Generic","submit_name":"test.exe","analysis_start_time":"2026-10-06T20:19:24+00:00","indicators_count":{"informative":100,"suspicious":13,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}],"processes":[{"pid":8096,"ppid":0,"name":"test.exe","command_line":"","sha256":"c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679","normalized_path":"C:\\test.exe","uid":"00000000-00008096","icon":"$2f"}],"all_imported_dlls":["cryptsp.dll","kernel32.dll","msvcp_win.dll","kernel.appcore.dll","uxtheme.dll","apphelp.dll","rpcrt4.dll","advapi32.dll","ntdll.dll","KernelBase.dll","fltLib.dll","oleaut32.dll","user32.dll","msvcp140.dll","vcruntime140.dll","ole32.dll","shlwapi.dll","bcryptprimitives.dll","win32u.dll","imm32.dll","combase.dll","vcruntime140_1.dll","VxSSL64.dll","ws2_32.dll","gdi32.dll","gdi32full.dll","ucrtbase.dll","msvcrt.dll","sechost.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"%PROGRAMFILES%\\CHORUSED\\CLEETTSUOM","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]},{"path":"%PROGRAMFILES%\\(x86)\\NPCAP\\MCCOOLYIOFF.INF","sources":[{"report_type":"sandbox","report_id":"6ac557cae719d68b180ee458"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac557cae719d68b180ee458"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample c60a8b74c2f1… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c60a8b74c2f1…. Malware family: Win/malicious_confidence_60%. Threat score 78/100. 7/27 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample c60a8b74c2f1… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c60a8b74c2f1…. Malware family: Win/malicious_confidence_60%. Threat score 78/100. 7/27 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c60a8b74c2f1cab1c4848310d98ea7e2d56cbb816790908b775c554bc500a679"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample c60a8b74c2f1… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c60a8b74c2f1…. Malware family: Win/malicious_confidence_60%. Threat score 78/100. 7/27 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]