26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 76:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T461,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample eacd44512510… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample eacd44512510…. Threat score 35/100. 0/26 AV engines flagged this file. 1 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348"],"about":{"@type":"SoftwareApplication","name":"eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin","applicationCategory":["compressed","innosetup"],"identifier":"eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T158f,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")28:Tece,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")29:T455,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")2a:T168e,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp, 00000000-00006320.00000001.176440.72F62000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp, 00000000-00006320.00000001.176440.72F62000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "ReadPhonebookFile: WaitForSingleObject Failed: Ret:%d, Error:%d" (Indicator: "WaitForSingleObject"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "WritePhonebookFile: WaitForSingleObject Failed: Ret:%d" (Indicator: "WaitForSingleObject"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp, 00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")2b:T971,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")2c:Tb94,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00006320.00000000.175001.72FD6000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp, 00000000-00006320.00000001.176440.72F62000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.72F13000.00000002.mdmp, 00000000-00006320.00000001.176440.72F62000.00000002.mdmp") Found reference to API "PbkPathInfoLoad: LoadLibrary failed %d" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "LoadLibrary %ws failed. %d" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006320.00000001.176440.72F51000.00000020.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00006320.00000001.176440.72F71000.00000020.mdmp")2d:T638,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007796.00000000.174880.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00007796.00000000.174880.0065E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00007796.00000000.174880.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com0m" - Source: "00000000-00007796.00000000.174880.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com0a" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0?wt]1-mlwashington1redmond1microsoft" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp") Found URL "http://www.microsoft.com0m" - Source: "00000000-00007796.00000001.176455.0065E000.00000004.mdmp")5c:T7e1,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")5d:T695,Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp")5e:T7c3,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")5f:Tdf6,Found registry query API: "RegOpenKeyExW" in file "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin" Found registry query API: "RegQueryValueExW" in file "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin" Found registry query API: "RegOpenKeyEx" in file "00000000-00007796.00000000.174880.00401000.00000020.mdmp" Found registry query API: "RegEnumKeyExW" in file "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin" Found registry query API: "RegEnumValueW" in file "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin" Found registry query API: "RegQueryInfoKeyW" in file "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006320.00000000.175001.72FED000.00000002.mdmp, 00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "SHGetValueW" in "00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00006320.00000001.176440.001BF000.00000002.mdmp" Found registry query API: "RegOpenKeyEx=%d" in "00000000-00006320.00000001.176440.02930000.00000004.mdmp" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp"60:Tbbd,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "eacd44512510f9232e6605e17c4f953454840a99f73b08a204bbc2ad16c6c348.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp, 00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006320.00000001.176440.001BF000.00000002.mdmp") Found reference to API "GetSidFromToken: GetTokenInformation failed with %d" (Indicator: "GetTokenInformation"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "GetSidFromToken: GetTokenInformation2 failed with %d" (Indicator: "GetTokenInformation"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp, 00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NetWkstaUserGetInfo(e=%d,u=(%ls))" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "NetWkstaUserGetInfo=%d" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00006320.00000001.176440.02930000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006320.00000001.176440.04952000.00000004.mdmp, 00000000-00006320.00000001.176440.0AB30000.00000004.mdmp")61:T50a,"