24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Variadic.A.348.Generic Sample daa63f8125e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample daa63f8125e1…. Malware family: Variadic.A.348.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05","keywords":["Malicious","Variadic.A.348.Generic","malware analysis","sandbox report","threat intelligence","daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05"],"about":{"@type":"SoftwareApplication","name":"sawd6ml136q4rm2r.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Variadic.A.348.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td79,Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")26:T7e4,Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")27:Ta73,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")28:T7e7,Found reference to API "LoadLibraryDelegate" (Indicator: "LoadLibrary"; File: "daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05.bin") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; File: "daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "LoadLibraryDelegate" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000001.133360.00F92000.00000002.mdmp") Found reference to API "_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000001.133360.00F92000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")29:T20f0,Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "daa63f8125e114d512992baeb50d3f011fdd1c6d025488451f9a513a8fb87b05.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.00F92000.00000002.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006288.00000001.133360.00F92000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp")2a:T915,Found string - \.\PhysicalDrive{0}; Source: "AMSI") Found string - \.\root\Microsoft\Windows\Defender; Source: "AMSI") Found string - \.\PhysicalDrive{0}; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string - \.\root\Microsoft\Windows\Defender; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string - \.\PHYSICALDRIVE0; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string - \\.\PHYSICALDRIVE0; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string - \\.\root\cimv2; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string - VMware Virtual SATA Hard Drive(Standard disk drives)\\.\PHYSICALDRIVE0Intel(R) Core(TM) i7-10700 CPU @ 2.90GHzMicrosoft Windows 10 Pro 64-bitVMware SVGA 3D26.02.20268; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string - \\.\PHYSICALDRIVE0`; Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp")2b:T85a,"9iqmgvw,czcthawte," - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(z1.3.36.3.3.2.8.1.1.7@eckp1.3.36.3.3.2.8.1.1.5@eckp1.3.36.3.3.2.8.1.1.13@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1@eckp1.2.156.11235.1.1.2.1ecdp1.3.36.3.3.2.8.1.1.8ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.5@eckp1.3.36.3.3.2.8.1.1.14ecdp1.3.36.3.3.2.8.1.1.9@eckp@1.3.36.3.3.2.8.1.1.9ecdp@1.3.36.3.3.2.8.1.1.6ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11ecdp1.3.36.3.3.2.8.1.1.12@eckp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.7ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.2ecdp1.3.36.3.3.2.8.1.1.14@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.2.840.10045.3.1.7ecdp" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006288.00000002.135280.039C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0[(;1atermiteedo" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(z1.3.36.3.3.2.8.1.1.7@eckp1.3.36.3.3.2.8.1.1.5@eckp1.3.36.3.3.2.8.1.1.13@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1@eckp1.2.156.11235.1.1.2.1ecdp1.3.36.3.3.2.8.1.1.8ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.5@eckp1.3.36.3.3.2.8.1.1.14ecdp1.3.36.3.3.2.8.1.1.9@eckp@1.3.36.3.3.2.8.1.1.9ecdp@1.3.36.3.3.2.8.1.1.6ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11ecdp1.3.36.3.3.2.8.1.1.12@eckp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.7ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.2ecdp1.3.36.3.3.2.8.1.1.14@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.2.840.10045.3.1.7ecdp" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006288.00000002.135280.20800000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006288.00000002.135280.3D922000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0[(;1atermiteedo" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(z1.3.36.3.3.2.8.1.1.7@eckp1.3.36.3.3.2.8.1.1.5@eckp1.3.36.3.3.2.8.1.1.13@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1@eckp1.2.156.11235.1.1.2.1ecdp1.3.36.3.3.2.8.1.1.8ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.5@eckp1.3.36.3.3.2.8.1.1.14ecdp1.3.36.3.3.2.8.1.1.9@eckp@1.3.36.3.3.2.8.1.1.9ecdp@1.3.36.3.3.2.8.1.1.6ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11ecdp1.3.36.3.3.2.8.1.1.12@eckp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.7ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.2ecdp1.3.36.3.3.2.8.1.1.14@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.2.840.10045.3.1.7ecdp" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006288.00000003.140832.20800000.00000004.mdmp")50:T6b2,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found string "+ncalrpc:[OLE91A2A37329939D92B33273BBCFA6]" (Indicator: "ncalrpc"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "B+ncalrpc:[OLE91A2A37329939D92B33273BBCFA6]" (Indicator: "ncalrpc"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "+ncalrpc:[OLE0B2C153CF56B8847FB143E5C84E0]" (Indicator: "ncalrpc"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")51:T5a6,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp")52:T180d,Found reference to API "3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.265",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9948411948,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9928561376,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "8512801431,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.390",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9948339876,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9913886829,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "8834389785,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.531",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9943672834,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "8842414495,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.531",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "8834049817,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.531",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "9893256505,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.968",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9909494616,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.968",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9043540095,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.609",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9943605912,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "8842480507,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.531",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9874281483,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.953",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9869340539,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:12.953",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "9913957025,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.984",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp") Found reference to API "25496508978,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:19.468",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "25467067326,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:19.453",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "1431,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.390",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "25453029385,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:19.453",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "25482484212,1368,3025,,RtlGetNtProductType,NTDLL.dll,"00:34:19.468",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "34389785,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:12.531",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found reference to API "25496563716,1368,3024,,RtlGetVersion,NTDLL.dll,"00:34:19.468",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp")53:T96d,Found registry query API: "NtQueryKey" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006288.00000001.133360.25258000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00006288.00000001.133360.25258000.00000002.mdmp"54:T8a2,"" (Indicator: "password"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp")5d:T17f5,Found string "ELECT * FROM Win32_DiskPartition WHERE BootPartition = true" (Indicator: " Win32_DiskPartition"; File: "AMSI") Found string "ELECT * FROM Win32_DiskPartition WHERE DiskIndex = {0}" (Indicator: " Win32_DiskPartition"; File: "AMSI") Found string "ELECT * FROM Win32_DiskDrive WHERE Index = 0" (Indicator: " Win32_DiskDrive"; File: "AMSI") Found string "ELECT * FROM Win32_DiskPartition WHERE BootPartition = true" (Indicator: " Win32_DiskPartition"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "ELECT * FROM Win32_DiskPartition WHERE DiskIndex = {0}" (Indicator: " Win32_DiskPartition"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "ELECT * FROM Win32_DiskDrive WHERE Index = 0" (Indicator: " Win32_DiskDrive"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "elect * from Win32_CacheMemory" (Indicator: " Win32_CacheMemory"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "ELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "ELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "ELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'" (Indicator: " Win32_PnPEntity"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'" (Indicator: " Win32_PnPEntity"; Source: "00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "T * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'" (Indicator: " Win32_PnPEntity"; Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp")5e:T475,Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006288-00000C2C-1023892200") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00006288-00000C2C-1024774927") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006288-00000C2C-1026697262") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00006288-00000C2C-1026697294") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp")5f:T78c,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006288.00000000.131438.039C0000.00000004.mdmp, 00000000-00006288.00000001.133360.039C0000.00000004.mdmp, 00000000-00006288.00000002.135280.039C0000.00000004.mdmp, 00000000-00006288.00000003.140832.039C0000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006288.00000000.131438.20800000.00000004.mdmp, 00000000-00006288.00000001.133360.20800000.00000004.mdmp, 00000000-00006288.00000002.135280.20800000.00000004.mdmp, 00000000-00006288.00000003.140832.20800000.00000004.mdmp")60:Te9b,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006288.00000001.133360.25258000.00000002.mdmp")61:T418,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000001.133360.25258000.00000002.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000002.135280.3D922000.00000002.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp")62:T749," HTTP/1.1 200 OK\nDate: Thu\n 26 Feb 2026 15:57:06 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: 9d40a2e07a92faa2-SJC with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006288.00000001.133360.06720000.00000004.mdmp, 00000000-00006288.00000003.140832.06720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00006288.00000000.131438.16720000.00000004.mdmp, 00000000-00006288.00000001.133360.1FAE0000.00000004.mdmp, 00000000-00006288.00000002.135280.16720000.00000004.mdmp, 00000000-00006288.00000003.140832.16720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69a06d2dc0dc641c37022a8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"