26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ce,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample dbf562f3798a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dbf562f3798a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/27 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4"],"about":{"@type":"SoftwareApplication","name":"LxHXQEbC.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44e,Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")28:T9f4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")29:T766,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1415823298 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1415832996 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1416010600 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1416018882 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1417690860 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1417699454 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1417807655 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1417817111 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1418761743 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1418769373 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1419173803 [PID: 1444] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queried SystemProcessInformation at 00000000-00001444-00000C15-1419182014 [PID: 1444]2a:T6a8,Found api reference "NCryptCreatePersistedKey" (Indicator: "NCryptCreatePersistedKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptExportKey" (Indicator: "NCryptExportKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptFinalizeKey" (Indicator: "NCryptFinalizeKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptFreeObject" (Indicator: "NCryptFreeObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptGetProperty" (Indicator: "NCryptGetProperty"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptImportKey" (Indicator: "NCryptImportKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptIsAlgSupported" (Indicator: "NCryptIsAlgSupported"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptOpenKey" (Indicator: "NCryptOpenKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptOpenStorageProvider" (Indicator: "NCryptOpenStorageProvider"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found api reference "NCryptSignHash" (Indicator: "NCryptSignHash"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")2b:T2784,Found XOR loop in file "LxHXQEbC.exe" at offset 163866; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 245781; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 332660; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 381526; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 381826; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 397461; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 437148; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 461215; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 467787; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 507840; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 559291; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 792529; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 859406; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 891212; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 918803; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1019570; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1081156; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1106791; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1181353; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1186166; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1201106; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1283875; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 1336871; code bytes = 30d0 Found XOR loop in file "LxHXQEbC.exe" at offset 268983; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 334762; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 413590; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 459830; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 460655; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 505531; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 543100; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 654401; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 737355; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 843392; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 871644; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 875951; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 898680; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 931165; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 946082; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 997362; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1064186; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1090149; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1106118; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1180332; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1196686; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1273185; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1347804; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1357159; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 1541286; code bytes = 33c1 Found XOR loop in file "LxHXQEbC.exe" at offset 221473; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 232744; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 260288; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 531522; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 674764; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 909595; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 909951; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 929639; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 957166; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 960798; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1059854; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1149062; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1173389; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1177571; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1198503; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1230490; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1241466; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1260596; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1303549; code bytes = 8030 Found XOR loop in file "LxHXQEbC.exe" at offset 1316304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 163866; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 245781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 332660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 381526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 381826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 397461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 437148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 461215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 507840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 559291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 792529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 859406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 918803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1019570; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1081156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1106791; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1186166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1201106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1283875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1336871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 268983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 334762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 413590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 459830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 460655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 505531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 543100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 654401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 737355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 843392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 871644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 875951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 898680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 931165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 946082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 997362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1064186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1090149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1106118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1196686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1273185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1347804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1357159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1541286; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 221473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 260288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 531522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 674764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 909595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 909951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 929639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 957166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 960798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1149062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1173389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177571; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1198503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241466; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1260596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1303549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1316304; code bytes = 80302c:T401,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")2d:T495,Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp"2e:T1ade,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000007f336a5b64e0887448e9ef00687d747548f1ef00401ea972bb262f29feffffff64f0ef00f77ea77208f0ef000000997400f1ef00107fa772e0df887408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000090f0ef00000000000800000000000000000000000000000000000000000000000000000067336a5b00000000d0f0ef0069923a75ffffffff3400000090f0ef0008000000000000000000997400f1ef0027943a7598f0ef000b00000000000000e8f0ef00 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038d2ef00dcd1ef00226ef3730000fd04000000002d6ef373bbcce3702d000000ecb7b77560d2ef000000b4002015fe02e861fd021400000080000000a0d1ef000000b40024d2ef0070c8f4739f6cf503feffffff2d000000d0ccc67527000000f4d1ef00856af5731c23fa7334d2ef00f85ff57308000000bb69f473b269f47353cfe3702d000000ecb7b77527000000d0ccc67508d2ef002d000000d0ccc6752700000038d2ef00856af5731c23fa7380d2ef007e8ac575ee8cc575738ac575109dce202d000000ecb7b77527000000d0ccc675b413fd044813fd04109dce2048d2ef00fc52037634d3ef00e084c575a8be2056feffffff738ac575 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000066f187d066f00000000d0a9b2740000ab749011ac7438bafc0270adf802788cff0200e8ef00feffffffa8eaef00506a4a7766bf53defeffffffc0e8ef00eaa9467738bafc0200000000788cff02a11400000a000b00b297066f5c76066f6876066f788cff02d854ff0214000000000000000000000038bafc02e8e8ef00cc2d4b77788cff0200000000848cff0200000000f800ff6e00000000cc0d24385ce8497768404877d403000019000000110000001000000050c0f70220e9ef008d9adc7308c0f7022c69fe020000000040e9ef002c05f7022c69fe0258e9ef000000ff6efeffffff0400000020afdc7300000000000000000300000048e9ef00 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000fc025005fb72000000002a00c073fc86b9732a00c073fb8c47770000000000000000fc86b97364e3ef000000000000000000000000002a00c0730900000038c5fc0209000000fc86b973000000005005fb722f3e6a001204000018dcef00b827ba07c0e5ef00401ea972bb262f29feffffff20e3ef007e9da772d0e2ef000000000000000000979da7724ce3ef000000000000000000000000000000000000000000000000000100000000000000010000000000000048e3ef000000000058e3ef00000000004ce3ef00000000000000000000000000c0e5ef00573e6a5b64e3ef0084da387501000000d6a9eea968e3ef00dab938750000f2725ce3ef00 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000000000001b804fd04b804fd0402000000000000001800000000000000c004fd048061fd04a3014777760001a9feffffff0000fd046002fd0400000000000000050000000018000000020000006002fd0418000000180000001800000018000000000000000000000048e3ef00506a4a77bebe53defeffffffd0e2ef00b71647771c00000028000000a802fd04bce2ef000407f26e0000fd040000000028000000000000000000000005000000030000000000fd041c000000000000001475fd04f0e2ef00ee1347771c000000ee13477700000000000000001c000000ffffffff10e3ef005072f3730000fd04000000001c0000000407f26e (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004677e8ba5a08e8ba5a0800000000c8a3fd0460c8590840ae5a083900000070c859084600250050f5467708a4590808a459080000000093ffe370f0a1fd0428a359080200000000a2fd040d00050050f54677c09bfd04c09bfd0400000000e8ba5a08309efd04189afd040c000000409efd040b000c0000085708640000005bfee37008a4590808a4590800000000feffffff8470f37368e3ef006570f3730000fd04000000008470f3730ffee370c09bfd04c09bfd0400000000e32eee6e08a45908b5ceea6e682a884730e3ef00176feb6ec4e3ef0070c8f473476ff503feffffff8470f3730a8eed6ec09bfd04f08ded6e90e3ef00a7ceea6e01000000 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004677a0b75a08a0b75a08000000000000000060c8590840ae5a082a00000050f5467780a8590880a85908000000008470f373f0a1fd0428a359080f00000000a2fd040d000200100c57086400000050f54677e09dfd04e09dfd0400000000a0b75a08309efd04189afd041d000000409efd040b001d00000857086400000080a8590880a8590800000000feffffff8470f37364e3ef006570f3730000fd04000000008470f37303fee370e09dfd04e09dfd0400000000e32eee6e80a85908b5ceea6e742a88472ce3ef00176feb6ec4e3ef0070c8f473476ff503feffffff8470f3730a8eed6ee09dfd04f08ded6e8ce3ef00a7ceea6e01000000504beb6e (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001444)2f:T4e4,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queries volume information of "C:\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" at 00000000-00001444-00000C17-1416954377 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001444-00000C17-1417130144 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001444-00000C17-1417246568 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001444-00000C17-1418042784 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00001444-00000C17-142056142330:T2699,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001444)31:Tac24,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter LsaLookupNames2 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter DestroyCursor (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001444)32:T197e,"SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select*from"%w".%s where %s order by rowid") "CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "create table x(type text,name text,tbl_name text,rootpage int,sql text)"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT sql FROM "%w".sqlite_schema WHERE type='table'AND name<>'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='index'" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select sql from "%w".sqlite_schema where type='index'"), "SELECT'INSERT INTO %s.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM %s.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select'insert into %s.'||quote(name)||' select*from"%w".'||quote(name)from %s.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "INSERT INTO %s.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "insert into %s.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "CREATE TABLE x" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "create table x"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "create table %q.sqlite_sequence(name,seq)"), "SELECT*FROM"%w"."%w"" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select*from"%w"."%w""), "INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "insert into %q.sqlite_master values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "delete from %q.%s where %s=%q"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q"), "DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='trigger'" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where name=%q and type='trigger'"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "SELECT*FROM"%w"" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select*from"%w""), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null")33:Tc8ed,Found reference to API (Indicator: "GetObject"; File: "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4") Found reference to API (Indicator: "MessageBox"; File: "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDescription"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReplaceFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormat"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TransactNamedPipe"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "BuildSecurityDescriptor"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindNextFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphore"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegisterClass"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtr"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClass"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValue"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtOpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpWriteData"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetHandleVerifier"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "BuildSecurityDescriptorW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidAcl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PathMatchSpecW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetShellWindow"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetPriorityClass"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHandleCount"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMitigationPolicy"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriorityBoost"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "K32GetPerformanceInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "K32QueryWorkingSetEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetInformationJobObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriorityBoost"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtDeleteKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtOpenKeyEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NtQueryValueKey"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlFormatCurrentUserKeyPath"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlFreeUnicodeString"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NCryptFreeObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "NCryptGetProperty"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetOption"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")34:T4d5,Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")35:Tdf4,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Common" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\Application\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\MediaPlayer\ShimInclusionList" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\Clients\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\ClientState\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\ClientStateMedium\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Clients\StartMenuInternet" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\RegisteredApplications" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\Google\Update" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Common\Rlz" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Failed to open registry key HKLM\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Failed to create/open registry key HKLM\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp36:T404,Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1444:168:WilStaging_02" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1444:168:WilStaging_02" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1444:64:WilError_01" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "Local\SM0:1444:168:WilStaging_02" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "SM0:1444:64:WilError_01" Process dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe created mutex with name "SM0:1444:168:WilStaging_02"37:T699,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]38:Tdf4,"Software\Google\Common\Rlz" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Failed to open registry key HKLM\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Failed to create/open registry key HKLM\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Common" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\Application\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\MediaPlayer\ShimInclusionList" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\Clients\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\ClientState\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Google\Update\ClientStateMedium\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Clients\StartMenuInternet" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Classes" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\RegisteredApplications" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Policies\Google\Update" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp39:T4bd3,"GET /time/1/current?cup2key=9:jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6XIvPKRYBe1M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100ffa8784948e4afbf2935a001356b58a5d6c02e1960dcb7149812bd5cf128accb022100ed8b5c7f1a29919d51a0862aae9f64871a3ec3bf3c8d35ba5e401eada87a1839:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100ffa8784948e4afbf2935a001356b58a5d6c02e1960dcb7149812bd5cf128accb022100ed8b5c7f1a29919d51a0862aae9f64871a3ec3bf3c8d35ba5e401eada87a1839:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Thu 28 May 2026 06:37:32 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313737393935303235323833322C227365727665725F6E6F6E6365223A2D362E30303238....... "GET /time/1/current?cup2key=9:PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD1hyq8HjjX4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 304402203c819ff87d16e7cde42f36ed41b95c3f3aa621595455b881f967710b96f4aeef02207757fb781a2109df3f3809f562f1bdd9c4cdfd48f93ba10a6e266b5cb8352272:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"304402203c819ff87d16e7cde42f36ed41b95c3f3aa621595455b881f967710b96f4aeef02207757fb781a2109df3f3809f562f1bdd9c4cdfd48f93ba10a6e266b5cb8352272:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Thu 28 May 2026 06:37:53 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313737393935303237333336372C227365727665725F6E6F6E6365223A2D332E37343733....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 28 May 2026 06:37:59 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=p9q97a3k.v.uydduLeoocjvNzCVt7MyyqoraVoTRqgA-1779950279.830459-1.0.1.1-GPZht.i7YpVIu6X1j5ZRsPPNZns78o6k8m1_SNk5GZ0OkXGMalzap0LT75nS9jYpKc8IJZy5IibSSyWJSvgkXvvzTQC4SUUNoCWiSEBvTOf0CkoK5kANCW0t48RKpAyo; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 28 May 2026 07:07:59 GMT Server: cloudflare CF-RAY: a02b4100e8ac5c19-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Thu 28 May 2026 06:37:34 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEYCIQCD8tFW78I6aZjMXVYV4IdZzHpcUmVztHPKJbZd30BfpQIhALy/yMfvm28osvbzGAl0Op0w1K1CSUwuj1r1EMnnHDx0 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Thu 28 May 2026 06:12:03 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 1531 with no response body "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 28 May 2026 06:37:34 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7086 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 85054 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AAVLpEhxcZMCTRda9Baccib4WIKhvjhBcZ0n2gMQrFeXCl93s19O8qz710pc1bykuzNbgYA Date: Wed 27 May 2026 19:11:03 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Thu 27 May 2027 19:11:03 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 41191 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: hn8JhJeOi6q7xPCftzr+j7 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 28 May 2026 06:37:40 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7086 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 85060 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1779950283242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C03066403BC65A01DA61103025264C1&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Thu 28 May 2026 06:37:45 GMT X-Amz-Cf-Pop: LAX53-P4 Set-Cookie: XID=1ACfd4728087ffa61f942fd1779950265; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1779950283242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C03066403BC65A01DA61103025264C1&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: yk9GeRmQ2f8XG_02m7pTcb5KxhK7W7ZImjPJcbwRoN22hkSme7I7wA== Via: 1.1 b09fd261fc6f7c40f02dbc422032fc38.cloudfront.net (CloudFront) with no response body "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: Q191IH7P2v/Z7+92nqGoyM Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 28 May 2026 06:37:47 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7086 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 85067 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1779950290300&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=30201F86F420675523CB08E1F56E66C4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Thu 28 May 2026 06:37:51 GMT X-Amz-Cf-Pop: LAX53-P4 Set-Cookie: XID=1452f5b946d5bbe87fcf8a11779950271; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1779950290300&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=30201F86F420675523CB08E1F56E66C4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: JCzFaLYlcbTc-5JD9c-1TA0SLzZ3pZrDhFTxPBgFAX6QBOJZQClBww== Via: 1.1 c6a4871893ac935ba2b308d02ff4cd7a.cloudfront.net (CloudFront) with no response body "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Thu 28 May 2026 06:37:53 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEUCIQDf6xdeve97WL1AAxKFeZz41S4j/0EZoO8fzwiLwIn8eAIgKI9XQwjhqbKvBEewfRg5U79gOIckIGcsRF+Z0j8nbvE= X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Thu 28 May 2026 06:37:53 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7086 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 85073 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Thu 28 May 2026 06:12:03 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 1550 with no response body "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AAVLpEhxcZMCTRda9Baccib4WIKhvjhBcZ0n2gMQrFeXCl93s19O8qz710pc1bykuzNbgYA Date: Wed 27 May 2026 19:11:03 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Thu 27 May 2027 19:11:03 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 41211 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT.......3a:T1e7b,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "KERNEL32" at base 77360000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74a20000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 729b0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "ADVAPI32.DLL" at base 74c30000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 728e0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "SHLWAPI.DLL" at base 75560000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 73e70000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "VERSION.DLL" at base 73b70000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72130000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "USER32.DLL" at base 74ab0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "MSCOREE.DLL" at base 72ac0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77110000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "PSAPI.DLL" at base 74980000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "RPCRT4.DLL" at base 75480000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "KERNEL32.DLL" at base 77360000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70c50000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "OLE32.DLL" at base 75a50000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73900000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77110000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 752a0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70bc0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70160000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "UXTHEME.DLL" at base 73900000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f940000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f830000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f0b0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "NTDLL.DLL" at base 77430000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "SHELL32.DLL" at base 75b50000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "BCRYPT.DLL" at base 72c20000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f080000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "IMM32.DLL" at base 74a20000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "COMCTL32.DLL" at base 6eff0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "GDI32.DLL" at base 74990000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "OLEAUT32.DLL" at base 75910000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "GDIPLUS.DLL" at base 73b90000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73b90000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "WINDOWSCODECS.DLL" at base 72f20000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "WLDP.DLL" at base 6efd0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "AMSI.DLL" at base 6efc0000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b70000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ef70000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSWOW64\PWX9X4J5.DLL" at base 6ef30000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ee90000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77360000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "USERENV.DLL" at base 6ef90000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74c30000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "NTDLL" at base 77430000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "SSPICLI.DLL" at base 73e50000 "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74cd00003b:T8ac,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4" file has an entrypoint instructions - "jmp dword ptr [0x402000],add eax, 0x49000001,add dword ptr [eax], eax,add byte ptr [eax - 0x47ffffff], cl,add dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "LxHXQEbC.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add eax, 0x49000001,add dword ptr [eax], eax,add byte ptr [eax - 0x47ffffff], cl,add dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3c:T112c,Process "RegSvcs.exe" (UID: 00000000-00000844) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "RegSvcs.exe" (UID: 00000000-00000844) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "chrome.exe" (UID: 00000000-00005196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00005196) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00005056) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5480_ITYAEAGMDEKMJZIW"" Process "msedge.exe" (UID: 00000000-00003528) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00003528) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00003528) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "chrmstp.exe" (UID: 00000000-00003120) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5480_ITYAEAGMDEKMJZIW"" Process "chrmstp.exe" (UID: 00000000-00003120) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrmstp.exe" (UID: 00000000-00003120) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003708) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_3528_MQOIIEDWAMHHUUZL", EDGE_USER_DATA_DIR="%TEMP%\lc2qog3q.3dt", EDGE_BROWSER_PID="3528"" Process "msedge.exe" (UID: 00000000-00003708) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "msedge.exe" (UID: 00000000-00005820) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\lc2qog3q.3dt", EDGE_METRICS_CLIENT_ID_HASH="8176572215795174179"" Process "msedge.exe" (UID: 00000000-00004524) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00004524) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004524) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005332) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_4524_QKRUQUOBSYFIIDAM", EDGE_USER_DATA_DIR="%TEMP%\xdtfumlo.om3", EDGE_BROWSER_PID="4524"" Process "msedge.exe" (UID: 00000000-00005332) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00005332) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002200) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%TEMP%\xdtfumlo.om3", EDGE_METRICS_CLIENT_ID_HASH="7907083134411279952"" Process "chrome.exe" (UID: 00000000-00007684) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "chrome.exe" (UID: 00000000-00007684) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00007684) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "chrome.exe" (UID: 00000000-00008000) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00008000) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00003888) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7684_TRXRIZNXTVXOXJUY""3d:Te0c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001444-00000C2D-1207583820] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001444-00000C2A-1416603892] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001444-00000C2A-1416705183] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001444-00000C2A-1416761686] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001444-00000C2A-1416925426] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001444-00000C2A-1416955485] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001444-00000C2A-1417021392] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001444-00000C2A-1417100923] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001444-00000C2A-1417140060] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001444-00000C2A-1417209807] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001444-00000C2A-1417319819] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001444-00000C2A-1417437948] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001444-00000C2A-1417465030] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001444-00000C2A-1417530207] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001444-00000C2A-1417748481] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001444-00000C2A-1418078851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001444-00000C2A-1418476985] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001444-00000C2A-1418504800] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001444-00000C2A-1418531901] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001444-00000C2A-1418856783] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001444-00000C2A-1419285327] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001444-00000C2A-1419394682] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001444-00000C2A-1421266917]3e:Td9f,Spawned process "RegSvcs.exe" (UID: 00000000-00000844) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00005480) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\jwwqncdh.4sm /pr ..." (UID: 00000000-00005196) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\jwwqncd ..." (UID: 00000000-00005056), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005468), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005004), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00008188), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00005584), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00005208), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extensi ..." (UID: 00000000-00007804), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extensi ..." (UID: 00000000-00001724), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00005916), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00003828), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00006280), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00007356), Spawned process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003528), Spawned process "chrmstp.exe" with commandline "--configure-user-settings --verbose-logging --system-level --cha ..." (UID: 00000000-00003120), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lc2qog3q.3dt /pr ..." (UID: 00000000-00003708), Spawned process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\lc2qog3 ..." (UID: 00000000-00005820) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007544) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004952) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-ups ..." (UID: 00000000-00003276) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --instant ..." (UID: 00000000-00001808) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-ups ..." (UID: 00000000-00001388) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000184)3f:Td9f,Spawned process "RegSvcs.exe" (UID: 00000000-00000844) Spawned process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00005480) Spawned process "chrome.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\jwwqncdh.4sm /pr ..." (UID: 00000000-00005196) Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\jwwqncd ..." (UID: 00000000-00005056), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005468), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005004), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00008188), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00005584), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00005208), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extensi ..." (UID: 00000000-00007804), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extensi ..." (UID: 00000000-00001724), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00005916), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00003828), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00006280), Spawned process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre- ..." (UID: 00000000-00007356), Spawned process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio - ..." (UID: 00000000-00003528), Spawned process "chrmstp.exe" with commandline "--configure-user-settings --verbose-logging --system-level --cha ..." (UID: 00000000-00003120), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%TEMP%\\lc2qog3q.3dt /pr ..." (UID: 00000000-00003708), Spawned process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\lc2qog3 ..." (UID: 00000000-00005820) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007544) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004952) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-ups ..." (UID: 00000000-00003276) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --instant ..." (UID: 00000000-00001808) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-ups ..." (UID: 00000000-00001388) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000184)40:T94d,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: C1:F0:67:29:13:0E:B5:C7:19:B4:A4:E5:52:71:26:7D:43:17:8A:B0; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 22:23:AA:C0:3B:78:20:8C:E2:B9:B3:D2:68:3A:EA:1F:61:C4:08:DF; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: E8:21:C5:38:D9:1A:C8:FD:0C:27:C0:2A:F5:5C:B4:D9:B8:61:32:68; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A0:20:9F:E4:EB:B9:7E:2F:51:C6:BD:BB:AF:02:44:35:C1:8D:84:74; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information)41:T7ae,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")42:Te67,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DBF562F3798A57E60A84EF9641D75404A39E26319929B67FCF31E3F1AEF143B4.EXE"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")43:T47f,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"44:T49c,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"45:Tdf4,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"46:Tc64,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\DBF562F3798A57E60A84EF9641D75404A39E26319929B67FCF31E3F1AEF143B4.EXE.CONFIG" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DBF562F3798A57E60A84EF9641D75404A39E26319929B67FCF31E3F1AEF143B4.EXE.LOG" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.config" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\XTXZ" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\DBF562F3798A57E60A84EF9641D75404A39E26319929B67FCF31E3F1AEF143B4.INI" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.INI" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"47:T4a7,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "c:\users\%osuser%\appdata\roaming\lxhxqebc.exe" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "c:\users\%osuser%\appdata\roaming\lxhxqebc.exe:zone.identifier" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "c:\users\%osuser%\appdata\local\temp\2wiuykrhaem.ps1" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "%appdata%\lxhxqebc.exe:zone.identifier" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "%appdata%\lxhxqebc.exe" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "%temp%\2wiuykrhaem.ps1" "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log"48:T9d7,Found http requests in header "GET /time/1/current?cup2key=9:jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6XIvPKRYBe1M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Found http requests in header "GET /time/1/current?cup2key=9:PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD1hyq8HjjX4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Found http requests in header "GET /" Found http requests in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144" Found http requests in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE" Found http requests in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1" Found http requests in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin" Found http requests in header "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx" Found http requests in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc" Found http requests in header "GET /b?rn=1779950283242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C03066403BC65A01DA61103025264C1&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null" Found http requests in header "GET /b?rn=1779950290300&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=30201F86F420675523CB08E1F56E66C4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null"49:T502,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")4a:T925,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")4b:T4c3e,Heuristic match: "ge.cy" Heuristic match: "%w.gl" Heuristic match: "9^.se" Heuristic match: "m+2.ly" Heuristic match: "x@.ht" Heuristic match: "`t:.dj" Pattern match: "http://tempuri.org/natijadataset.xsd" Pattern match: "http://www.w3.org/2001/xmlschema" Heuristic match: "clients2.google.com" Heuristic match: "icanhazip.com" Heuristic match: "clientservices.googleapis.com" Heuristic match: "safebrowsingohttpgateway.googleapis.com" Heuristic match: "accounts.google.com" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "mail.gunsaldi.com" Pattern match: "www.google.com" Heuristic match: "$this.name" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://james.newtonking.com/projects/json" Heuristic match: "json.net is a popular high-performance json framework for .net" Heuristic match: "json.net" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "https://support.google.com/chrome?p=chrome_uninstall_survey" Heuristic match: "..\..\chrome\installer\setup\setup_main.cc" Heuristic match: "..\..\chrome\installer\setup\uninstall.cc" Heuristic match: "..\..\chrome\browser\enterprise\connectors\device_trust\key_management\core\network\win_key_network_delegate.cc" Heuristic match: "..\..\chrome\browser\enterprise\connectors\device_trust\key_management\installer\key_rotation_manager_impl.cc" Heuristic match: "..\..\chrome\browser\enterprise\connectors\device_trust\key_management\installer\management_service\rotate_util.cc" Heuristic match: "!(e..\..\third_party\abseil-cpp\absl\base\internal\throw_delegate.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\strings\internal\cord_rep_btree.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\internal\win32_waiter.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\mutex.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\base\internal\low_level_alloc.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\log\internal\log_sink_set.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\field.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\scattered_heap_buffer.cc" Heuristic match: "?..\..\third_party\perfetto\src\base\time.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\event_context.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\internal\tracing_muxer_fake.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\null_trace_writer.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc" Heuristic match: "..\..\chrome\installer\util\delete_after_reboot_helper.cc" Heuristic match: "..\..\chrome\installer\util\lzma_util.cc" Heuristic match: "..\..\chrome\installer\util\self_cleaning_temp_dir.cc" Heuristic match: "..\..\chrome\installer\util\unbuffered_file_writer.cc" Heuristic match: "..\..\third_party\lzma_sdk\google\seven_zip_reader.cc" Heuristic match: "..\..\chrome\installer\util\conditional_work_item_list.cc" Heuristic match: "..\..\chrome\installer\util\copy_tree_work_item.cc" Heuristic match: "..\..\chrome\installer\util\create_dir_work_item.cc" Heuristic match: "..\..\chrome\installer\util\create_reg_key_work_item.cc" Heuristic match: "..\..\chrome\installer\util\delete_reg_key_work_item.cc" Heuristic match: "..\..\chrome\installer\util\delete_reg_value_work_item.cc" Heuristic match: "..\..\chrome\installer\util\delete_tree_work_item.cc" Heuristic match: "..\..\chrome\installer\util\install_service_work_item_impl.cc" Heuristic match: "..\..\chrome\installer\util\move_tree_work_item.cc" Heuristic match: "..\..\chrome\installer\util\registry_key_backup.cc" Heuristic match: "..\..\chrome\installer\util\registry_util.cc" Heuristic match: "..\..\chrome\installer\util\set_reg_value_work_item.cc" Heuristic match: "..\..\chrome\installer\util\work_item_list.cc" Pattern match: "https://clients2.google.com/cr/report" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "..\..\chrome\browser\enterprise\connectors\device_trust\key_management\core\persistence\win_key_persistence_delegate.cc" Heuristic match: "blink.net" Heuristic match: "..\..\chrome\installer\setup\user_hive_visitor.cc" Heuristic match: "..\..\chrome\installer\setup\unpack_archive.cc" Heuristic match: "..\..\chrome\installer\setup\setup_util.cc" Heuristic match: "..\..\chrome\installer\setup\launch_chrome.cc" Heuristic match: "..\..\chrome\installer\setup\installer_state.cc" Heuristic match: "..\..\chrome\installer\setup\update_active_setup_version_work_item.cc" Heuristic match: "..\..\chrome\installer\setup\channel_override_work_item.cc" Heuristic match: "..\..\chrome\installer\setup\install_worker.cc" Heuristic match: "..\..\chrome\installer\setup\install.cc" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "..\..\chrome\installer\setup\downgrade_cleanup.cc" Heuristic match: "..\..\chrome\installer\setup\google_chrome_behaviors.cc" Heuristic match: "..\..\base\win\wmi.cc" Heuristic match: "..\..\base\win\windows_version.cc" Heuristic match: "..\..\base\win\win_util.cc" Heuristic match: "..\..\base\win\security_util.cc" Heuristic match: "..\..\base\win\resource_exhaustion.cc" Heuristic match: "..\..\base\win\object_watcher.cc" Heuristic match: "..\..\base\win\elevation_util.cc" Heuristic match: ".a..\..\base\time\time_win.cc" Heuristic match: "..\..\base\threading\platform_thread_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_win.cc" Heuristic match: "..\..\base\synchronization\condition_variable_win.cc" Heuristic match: "..\..\base\process\process_info_win.cc" Heuristic match: "..\..\base\process\launch_win.cc" Heuristic match: "..\..\base\native_library_win.cc" Heuristic match: "..\..\base\win\message_window.cc" Heuristic match: "..\..\base\message_loop\message_pump_win.cc" Heuristic match: "..\..\base\files\memory_mapped_file_win.cc" Heuristic match: "..\..\base\files\file_win.cc" Heuristic match: "..\..\base\files\file_util_win.cc" Heuristic match: "..\..\base\files\file_enumerator_win.cc" Heuristic match: "..\..\base\file_version_info_win.cc" Heuristic match: "..\..\base\metrics\persistent_histogram_storage.cc" Heuristic match: "..\..\base\files\important_file_writer_cleaner.cc" Heuristic match: "..\..\base\files\important_file_writer.cc" Heuristic match: "..\..\base\files\file_util.cc" Heuristic match: "..\..\base\values.cc" Heuristic match: "..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\threading\thread.cc" Heuristic match: "..\..\base\task\thread_pool\thread_group_impl.cc" Heuristic match: "..\..\base\task\thread_pool\task_tracker.cc" Heuristic match: "..\..\base\task\thread_pool\sequence.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_task_runner_delegate.cc" Heuristic match: "..\..\base\task\thread_pool\delayed_task_manager.cc" Heuristic match: "..\..\base\task\sequence_manager\work_tracker.cc" Heuristic match: "..\..\base\task\sequence_manager\work_queue.cc" Heuristic match: "..\..\base\task\sequence_manager\task_queue_impl.cc" Heuristic match: "..\..\base\task\execution_fence.cc" Heuristic match: "..\..\base\synchronization\waitable_event.cc" Heuristic match: "..\..\base\run_loop.cc" Heuristic match: "a..\..\base\profiler\thread_group_profiler.cc" Heuristic match: "..\..\base\profiler\suspendable_thread_delegate_win.cc" Heuristic match: "..\..\base\profiler\stack_sampling_profiler.cc" Heuristic match: "..\..\base\profiler\stack_sampler.cc" Heuristic match: "..\..\base\metrics\statistics_recorder.cc" Heuristic match: "..\..\base\metrics\sample_vector.cc" Heuristic match: "..\..\base\metrics\persistent_sample_map.cc" Heuristic match: "..\..\base\metrics\persistent_memory_allocator.cc" Heuristic match: "..\..\base\metrics\histogram.cc" Heuristic match: "..\..\base\metrics\field_trial_params.cc" Pattern match: "extensions.database.open/0x" Heuristic match: "..\..\base\trace_event\process_memory_dump.cc" Heuristic match: "..\..\chrome\common\chrome_paths.cc" Heuristic match: "..\..\url\gurl.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\mem.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\p_ec.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\p_ed25519.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\p_x25519.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\evp_ctx.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\rsa\rsa_asn1.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\rsa\rsa_crypt.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\p_rsa.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\p_dsa.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\ecdsa\ecdsa_asn1.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\ecdh\ecdh.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\ec\ec_asn1.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\dsa\dsa_asn1.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\bytestring\cbb.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\bn\bn_asn1.cc" Heuristic match: "i..\..\base\win\shortcut.cc" Heuristic match: "..\..\chrome\installer\util\shell_util.cc" Heuristic match: "..\..\chrome\installer\util\install_util.cc" Heuristic match: "..\..\chrome\installer\util\initial_preferences.cc" Heuristic match: "..\..\chrome\installer\util\google_update_util.cc" Heuristic match: "..\..\chrome\installer\util\google_update_settings.cc" Heuristic match: "..\..\chrome\installer\util\delete_old_versions.cc" Heuristic match: "..\..\chrome\installer\util\app_commands.cc" Heuristic match: "..\..\chrome\installer\util\app_command.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\repeated_field.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\wire_format_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\message_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream_impl_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\arena.cc" Heuristic match: "..\..\mojo\public\cpp\system\simple_watcher.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\evp\evp_asn1.cc" Heuristic match: "..\..\crypto\unexportable_key_win.cc" Heuristic match: "..\..\crypto\keypair.cc" Heuristic match: "..\..\mojo\public\c\system\thunks.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crashpad_client_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\settings.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\process_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\initial_client_data.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\critical_section_with_debug_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\directory_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\prune_crash_reports.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc" Heuristic match: "@..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_set_event.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\session_end_watcher.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\misc\paths_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\handler_main.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\user_stream_data_source.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_seeker.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\minidump_to_upload_parameters.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\crash_report_upload_thread.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writable.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_rva_list_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_string_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_memory_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_name_list_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_unloaded_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_handle_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_simple_string_dictionary_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_crashpad_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_byte_array_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_annotation_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\module_version.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_range.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\crashpad_types\crashpad_info_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_annotation_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\memory_snapshot.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\capture_memory.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\net\http_transport_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\net\http_body_gzip.cc" Heuristic match: "..\..\components\winhttp\scoped_hinternet.cc" Heuristic match: "..\..\components\winhttp\proxy_configuration.cc" Heuristic match: "..\..\components\winhttp\network_fetcher.cc" Heuristic match: "..\..\components\gwp_asan\crash_handler\crash_handler.cc" Heuristic match: "..\..\components\gwp_asan\common\allocator_state.cc" Heuristic match: ", joka sallii mdns-liikenteen.uinbound na panuntunan para sa google chrome canary upang payagan ang trapiko ng mdns.kr" Heuristic match: "veloppeurs autorisant le trafic mdns.ir" Heuristic match: "jra.jo" Heuristic match: "ing.im" Heuristic match: "buj ponownie.vn" Heuristic match: "o. feche o google chrome e tente novamente.xn" Pattern match: "setup.exe/idr_eula_css.css" Pattern match: "setup.exe/idr_eula_jsc.js" Pattern match: "setup.exe/eula/idr_eula_ico.png" Pattern match: "https://support.google.com/chrome/?p=usage_stats_crash_reports"4c:Tb96,Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h1q>-" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0]" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0)" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0n:" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003120.00000000.156684.09FD0000.00000004.mdmp") Found URL "https://support.google.com/chrome?p=chrome_uninstall_surveyopenroot\cimv2win32_processcreatecommandlinereturnvalueprocessidsoftware\microsoft\windows" - Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found URL "https://clients2.google.com/cr/reportcopyright" - Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance'>" - Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found URL "https://support.google.com/chrome/?p=usage_stats_crash_reports" - Source: "00000000-00003120.00000000.156684.DF307000.00000002.mdmp")4d:T19c3,GET /time/1/current?cup2key=9:jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6XIvPKRYBe1M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET /time/1/current?cup2key=9:PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD1hyq8HjjX4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm gzip Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: hn8JhJeOi6q7xPCftzr+j7 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /b?rn=1779950283242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C03066403BC65A01DA61103025264C1&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1 i Ms-Cv: Q191IH7P2v/Z7+92nqGoyM Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /b?rn=1779950290300&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=30201F86F420675523CB08E1F56E66C4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 4e:T27cd,Contains base62 string in header "jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6X" in header "GET /time/1/current?cup2key=9:jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6XIvPKRYBe1M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:jqn7vZKgKDSXkMRNakHhCUXw6Fp9FdD6XIvPKRYBe1M&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD" in header "GET /time/1/current?cup2key=9:PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD1hyq8HjjX4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:PyNH9orNmX6Q7E90nGkh7qQjQE2tZp_SD1hyq8HjjX4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDA" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dnmmhkkegccagdldgiimedpiccmgmied" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "nmmhkkegccagdldgiimedpiccmgmiedaX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-144.0.7559.133Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3w4dY4DKgd6rElhsRelgcAxlKa5d02n9h" in header "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: hn8JhJeOi6q7xPCftzr+j7Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: hn8JhJeOi6q7xPCftzr+j7Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "3Dghbmnnjooekpmoecnnnilnnbdlolhkh" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: Q191IH7P2v/Z7+92nqGoyMAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ghbmnnjooekpmoecnnnilnnbdlolhkhiX" in header "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2Host: clients2.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsX-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-145.0.3800.58Sec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9X-Goog-Update-Interactivity: fgPriority: u=1, iMs-Cv: Q191IH7P2v/Z7+92nqGoyMAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"4f:T909,Found HTTPS GET request to https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=144 Found HTTPS GET request to https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 Found HTTPS POST request to https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx Found HTTPS GET request to https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3 puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc Found HTTPS GET request to https://sb.scorecardresearch.com/b?rn=1779950283242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C03066403BC65A01DA61103025264C1&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null Found HTTPS GET request to https://sb.scorecardresearch.com/b?rn=1779950290300&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=30201F86F420675523CB08E1F56E66C4&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null50:T620,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")51:Teac,"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001444) "dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001444)52:T5b3,Found string "ECDSA_P2." (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "..\..\third_party\boringssl\src\crypto\ecdsa\ecdsa_asn1.cc" (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "..\..\third_party\boringssl\src\crypto\fipsmodule\ecdsa\ecdsa.cc.inc" (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found string "SignECDSA" (Indicator: "ecdsa"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")53:T70b,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")54:T963,Found reference to API "Could not GetFileAttributes for" (Indicator: "GetFileAttributes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")55:T432,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")56:Tb22,Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp")57:T1562,"POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Thu 28 May 2026 06:37:34 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmJw0JBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDse7o_QtsAjtOtq1lVNJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwNTTQM7CILzAAAMHAH6w" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Thu 28 May 2026 06:37:53 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmII0pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDcfDo_QtsAjP2nrzOpKSblF8Yn5mSmleSWVKZk1lckpicnF-aV1JcnFpUlloUb2RgZGZgamigZ2ARX2AAANkEIBM" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body58:T3b59,Process "chrome.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\jwwqncdh.4sm"" (UID: 00000000-00005480) Process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=1908,i,9879115764653545206,9417291454486040692,262144 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2200 /prefetch:2" (UID: 00000000-00005056) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --metrics-shmem-handle=2252,i,12610546426768868962,2375826252076691958,524288 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3968 /prefetch:3" (UID: 00000000-00005468) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --metrics-shmem-handle=2364,i,5807428655349459472,8778521880361569694,524288 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3992 /prefetch:8" (UID: 00000000-00005004) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2447251917 --metrics-shmem-handle=2976,i,10539906972694387853,17031144520958687082,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4144 /prefetch:1" (UID: 00000000-00008188) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2447616165 --metrics-shmem-handle=3008,i,14570897824014403826,497481917348729823,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4176 /prefetch:1" (UID: 00000000-00005584) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2447835587 --metrics-shmem-handle=3388,i,8123209511515498596,17817304677077065840,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4228 /prefetch:1" (UID: 00000000-00005208) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2448074281 --metrics-shmem-handle=3408,i,8183347781363443111,12284866864963149844,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4208 /prefetch:2" (UID: 00000000-00007804) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --extension-process --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2448375616 --metrics-shmem-handle=3912,i,8905057111680512193,7058442353519943586,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3476 /prefetch:2" (UID: 00000000-00001724) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --metrics-shmem-handle=4276,i,11267931921166753464,15930099182801438958,524288 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4272 /prefetch:8" (UID: 00000000-00005916) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --metrics-shmem-handle=4928,i,3484090825553080119,696880452268648492,524288 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4932 /prefetch:8" (UID: 00000000-00003828) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2451080669 --metrics-shmem-handle=5048,i,9347926120986273746,1677875563761703582,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5092 /prefetch:1" (UID: 00000000-00006280) Process "chrome.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\jwwqncdh.4sm" --no-pre-read-main-dll --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2451287985 --metrics-shmem-handle=5064,i,1286487449383196570,257435616156019088,2097152 --field-trial-handle=2204,i,7493794509803195346,12739582748572404430,262144 --variations-seed-version=20260130-010011.354000 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5128 /prefetch:1" (UID: 00000000-00007356) Process "msedge.exe" with commandline "--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="%TEMP%\\lc2qog3q.3dt"" (UID: 00000000-00003528) Process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --user-data-dir="%TEMP%\\lc2qog3q.3dt" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --metrics-shmem-handle=1948,i,12624596132364249608,6729114767784089111,262144 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2288 /prefetch:2" (UID: 00000000-00005820) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="%TEMP%\\lc2qog3q.3dt" --startup-read-main-dll --metrics-shmem-handle=2156,i,7893972841545870565,1852461634210480725,524288 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=4520 /prefetch:3" (UID: 00000000-00007544) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="%TEMP%\\lc2qog3q.3dt" --startup-read-main-dll --metrics-shmem-handle=2456,i,17884923364913060359,13363641021328899259,524288 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=4608 /prefetch:8" (UID: 00000000-00004952) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2454642984 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3052,i,16739146427768973486,2020128726683687178,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4896 /prefetch:1" (UID: 00000000-00003276) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --instant-process --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2455020168 --skip-read-main-dll --metrics-shmem-handle=3056,i,7297826757216723473,14587601289546287957,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4844 /prefetch:1" (UID: 00000000-00001808) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2455482096 --skip-read-main-dll --metrics-shmem-handle=3392,i,9799570879453607941,17616768760860380543,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4996 /prefetch:1" (UID: 00000000-00001388) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="%TEMP%\\lc2qog3q.3dt" --skip-read-main-dll --metrics-shmem-handle=3480,i,1826100236829196051,16305997452383616581,524288 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4716 /prefetch:8" (UID: 00000000-00000184) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2456477865 --skip-read-main-dll --metrics-shmem-handle=3500,i,3479970472937172528,2019498296933184917,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4956 /prefetch:1" (UID: 00000000-00004228) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2456867030 --skip-read-main-dll --metrics-shmem-handle=3516,i,12843011169549827607,5414559847466804352,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5064 /prefetch:2" (UID: 00000000-00006916) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2457178172 --skip-read-main-dll --metrics-shmem-handle=3536,i,2434308958104977771,16163867469424512287,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5084 /prefetch:1" (UID: 00000000-00007180) Process "msedge.exe" with commandline "--type=renderer --user-data-dir="%TEMP%\\lc2qog3q.3dt" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1779947824348341 --launch-time-ticks=2457521531 --skip-read-main-dll --metrics-shmem-handle=3564,i,18016307962018766980,4591643171853843342,2097152 --field-trial-handle=2284,i,1589762744763505085,8845081993387325707,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5248 /prefetch:2" (UID: 00000000-00004724)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790497439874,"unified_at":"2026-09-27T08:23:59.874Z","metadata":{"hashes":{"sha256":"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4","sha1":"df4a256e73d2de1d6c6ffd9a608e6620f1fce1bb","md5":"6a6435d47779e9d357de3f421d6b03bb","sha512":"2f7798a4151fef2dad4fadf5a61a2a41391674bff935d9a36f90d311cc337c7d016c25a315a7f5571c0c3255bed79b2b7cc59beea7c73aeead8d9db3d96ee090","ssdeep":"24576:XAEFT0DRIIv36hEUSdOuJBG7Yvhi7Xc+M0kz/sdmw8zRDQeL4jNa:X3FQd1E5uBGkvhY38z266","ssdeep_chunks":["24576:XAEFT0D","24576:AEFT0DR","24576:EFT0DRI","24576:FT0DRII","24576:T0DRIIv","24576:0DRIIv3","24576:DRIIv36","24576:RIIv36h","24576:IIv36hE","24576:Iv36hEU","24576:v36hEUS","24576:36hEUSd","24576:6hEUSdO","24576:hEUSdOu","24576:EUSdOuJ","24576:USdOuJB","24576:SdOuJBG","24576:dOuJBG7","24576:OuJBG7Y","24576:uJBG7Yv","24576:JBG7Yvh","24576:BG7Yvhi","24576:G7Yvhi7","24576:7Yvhi7X","24576:Yvhi7Xc","24576:vhi7Xc+","24576:hi7Xc+M","24576:i7Xc+M0","24576:7Xc+M0k","24576:Xc+M0kz","24576:c+M0kz/","24576:+M0kz/s","24576:M0kz/sd","24576:0kz/sdm","24576:kz/sdmw","24576:z/sdmw8","24576:/sdmw8z","24576:sdmw8zR","24576:dmw8zRD","24576:mw8zRDQ","24576:w8zRDQe","24576:8zRDQeL","24576:zRDQeL4","24576:RDQeL4j","24576:DQeL4jN","24576:QeL4jNa","49152:XAEFT0D","49152:AEFT0DR","49152:EFT0DRI","49152:FT0DRII","49152:T0DRIIv","49152:0DRIIv3","49152:DRIIv36","49152:RIIv36h","49152:IIv36hE","49152:Iv36hEU","49152:v36hEUS","49152:36hEUSd","49152:6hEUSdO","49152:hEUSdOu","49152:EUSdOuJ","49152:USdOuJB","49152:SdOuJBG","49152:dOuJBG7","49152:OuJBG7Y","49152:uJBG7Yv","49152:JBG7Yvh","49152:BG7Yvhi","49152:G7Yvhi7","49152:7Yvhi7X","49152:Yvhi7Xc","49152:vhi7Xc+","49152:hi7Xc+M","49152:i7Xc+M0","49152:7Xc+M0k","49152:Xc+M0kz","49152:c+M0kz/","49152:+M0kz/s","49152:M0kz/sd","49152:0kz/sdm","49152:kz/sdmw","49152:z/sdmw8","49152:/sdmw8z","49152:sdmw8zR","49152:dmw8zRD","49152:mw8zRDQ","49152:w8zRDQe","49152:8zRDQeL","49152:zRDQeL4","49152:RDQeL4j","49152:DQeL4jN","49152:QeL4jNa","24576:X3FQd1E","24576:3FQd1E5","24576:FQd1E5u","24576:Qd1E5uB","24576:d1E5uBG","24576:1E5uBGk","24576:E5uBGkv","24576:5uBGkvh","24576:uBGkvhY","24576:BGkvhY3","24576:GkvhY38","24576:kvhY38z","24576:vhY38z2","24576:hY38z26","24576:Y38z266"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"LxHXQEbC.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1573376,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779950217000,"last_seen":1779950217000,"last_multi_scan":1779950217000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["sourcecodeleaked","misakanetwork","botnet","criminal","malicious","evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":219,"suspicious_count":19,"malicious_count":10,"total":248},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AQM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.MUC1.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Attempts to disable browser security sandbox"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Creates file in AppData directory"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"suspicious","value":"Contacts Mail Related Domain Names"},{"type":"malicious","value":"Sends network traffic on a typical mail related ports"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"compression de l'archive par le programme d'installation. Veuillez t\" (Source: \"00000000-00003120.00000000.156684.DF307000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc failed\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"LxHXQEbC.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService failed\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"LoadResource with parameter {'hModule': '139984897', 'hResInfo': '139986144'}\" (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"LoadResource with parameter {'hModule': '139984897', 'hResInfo': '139986176'}\" (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"LoadResource with parameter {'hModule': '139984897', 'hResInfo': '139986192'}\" (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"LoadResource with parameter {'hModule': '139984897', 'hResInfo': '139986160'}\" (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\"\n Observed function \"ResourceManager.GetObject\" in \"LxHXQEbC.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ScopedMayLoadLibraryAtBackgroundPriority\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfig2\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\"\n Observed function \"System.Reflection.Load\" in \"LxHXQEbC.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003120.00000000.156684.09FD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Device trust key rotation failed. Could not send public key to DM server. HTTP Status:\" (Indicator: \"public key\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.88629","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001444-00000C2B-1417585381\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001444-00000C2B-1417585381\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00001444-00000C2B-1417901594\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001444-00000C2B-1416760544\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001444-00000C2B-1416761054\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfig failed\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"QueryServiceConfig\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"QueryServiceConfig2\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetDateFormat\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00001444-00000C2B-1421500108\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00001444-00000C2B-1421500131\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001444)\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"IsWow64Process\" with parameter \"1444\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"K.$IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"::IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set JArray values with invalid key value: {0}. Int32 array index expected.\" (Indicator: \"set \"; File: \"AMSI\")\n Found string \"Set JConstructor values with invalid key value: {0}. Argument position index expected.\" (Indicator: \"set \"; File: \"AMSI\")\n Found string \"Set JObject values with invalid key value: {0}. Object property name expected.\" (Indicator: \"set \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver Windows 10 eller nyere.9F\" (Indicator: \"ver \") in Source: 00000000-00003120.00000000.156684.DF307000.00000002.mdmp\n Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00003120.00000000.156684.DF307000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" writes to a file \"%APPDATA%\\LxHXQEbC.exe:Zone.Identifier\"\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" writes to a file \"%APPDATA%\\LxHXQEbC.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"::OpenSCManager Failed\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"CopyFileW\" to copy C:\\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe to new location %APPDATA%\\LxHXQEbC.exe (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003120.00000000.156684.09FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"clients2.google.com\"\n \"icanhazip.com\"\n \"clientservices.googleapis.com\"\n \"safebrowsingohttpgateway.googleapis.com\"\n \"accounts.google.com\"\n \"clients2.googleusercontent.com\"\n \"sb.scorecardresearch.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.153.119:443\"\n \"142.251.218.78:80\"\n \"142.251.218.142:443\"\n \"142.251.218.138:443\"\n \"142.250.113.84:443\"\n \"142.251.218.78:443\"\n \"142.251.218.129:443\"\n \"18.164.174.120:443\"\n \"52.123.225.100:443\"\n \"104.16.184.241:80\"\n \"5.252.153.116:587\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryAndGetError\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW failed\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateFileVersionInfoWin\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"chrome.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"2wiuykrhaem.ps1\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"LxHXQEbC.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\crashpad_%lu_","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70C50000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70C50000\n \"chrome.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FFAE0000\n \"msedge.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FFAE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6EFC0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6EF40000\n \"chrome.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 37610000\n \"msedge.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 37610000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 743C0000\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72C20000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 743C0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72C20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72130000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72130000\n \"chrome.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 010E0000\n \"msedge.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 010E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75480000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75480000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" was detected as \".NET\" and name: \"Library\"\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"LxHXQEbC.exe\" was detected as \".NET\" and name: \"Library\"\n \"LxHXQEbC.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"LxHXQEbC.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" has an executable section named \".text\"\n \"LxHXQEbC.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x17f800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x17f678\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\" [Source: 00000000-00001444-00000BC1-1421419311], Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" [Source: 00000000-00001444-00000BC0-1421484044]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"clients2.google.com\"\n \"clients2.googleusercontent.com\"\n \"clientservices.googleapis.com\"\n \"icanhazip.com\"\n \"mail.gunsaldi.com\"\n \"safebrowsingohttpgateway.googleapis.com\"\n \"sb.scorecardresearch.com\"\n \"www.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$40","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"LxHXQEbC.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\2wiuykrhaem.ps1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ScopedMayLoadLibraryAtBackgroundPriority\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"LxHXQEbC.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\LxHXQEbC.exe]- [targetUID: 00000000-00001444]\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log]- [targetUID: 00000000-00001444]\n \"2wiuykrhaem.ps1\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\2wiuykrhaem.ps1]- [targetUID: 00000000-00001444]\n \"LxHXQEbC.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" queries basic process information of the \"C:\\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" (UID: 1444)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$47","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log\"\n \"dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\dbf562f3798a57e60a84ef9641d75404a39e26319929b67fcf31e3f1aef143b4.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"::GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"forged shutdown request, got:\" (Indicator: \" shutdown \"; Source: \"00000000-00003120.00000000.156684.DF1E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.218.78 on port 80\n HTTP traffic to 104.16.184.241 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"clientservices.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"safebrowsingohttpgateway.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"16.0.0.0\"\n \"0.0.0.0\"\n \"18.9.6.0\"\n \"13.0.0.0\"\n \"4.0.0.0\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a17e288dc6b9d403508a1f7"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\":J^C5%iWCr/