24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 89:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Malware Sample f5056d55f44c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f5056d55f44c…. Malware family: TR/Malware. Threat score 100/100. 1/27 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be","keywords":["Malicious","TR/Malware","malware analysis","sandbox report","threat intelligence","f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be"],"about":{"@type":"SoftwareApplication","name":"f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin","applicationCategory":["compressed","innosetup"],"identifier":"f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Malware","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1bf7,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp")26:Tdb5,Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp")27:T418,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")28:T577,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")29:T1bc5,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")2a:T9c8,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")2b:Tbbe,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.00513000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004928.00000001.167240.00513000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.166268.723C1000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005504.00000000.166268.723E1000.00000020.mdmp, 00000000-00005504.00000000.166268.72446000.00000002.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005504.00000000.166268.723E1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.723D1000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.723D1000.00000002.mdmp")2c:T521,Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; File: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "ZwSetValueKey" (Indicator: "ZwSetValueKey"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004928.00000001.167240.00513000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004928.00000001.167240.00513000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp")2d:T426,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")2e:T6d2,Found PE header "MZ" - Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000001.170845.03110000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000001.170845.051A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000160.00000002.172765.05D70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004928.00000001.167240.00513000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005504.00000001.167197.05340000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005504.00000001.167197.0A924000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007324.00000001.171242.00920000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007324.00000001.171242.04C4F000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000001.169435.04E70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000001.169435.0AD00000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000002.171005.04E70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp")2f:T750,"" (Indicator: "enumchildwindows"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "WMRSendMessageString" (Indicator: "sendmessage"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp")3a:T27ba,"GrSoftware\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "ft\Windows\CurreSOFTWARE\Microso" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Aomei Partition Assistant_is1" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{04F850ED-FD0F-4ED1-AE1B-4498165BF3D2}_is1" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02F850ED-FD0E-4ED1-BE0B-5498165BF301}_is1" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\ampa" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "System\CurrentControlSet\Control" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\hivelist" in Source: 00000000-00005504.00000001.167197.724C1000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007324.00000001.171242.02AC0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00007324.00000001.171242.04C4F000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007444.00000000.167515.031B0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\VAN\{6705C562-0AE7-40EA-8474-F39DAB1813D0}" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\RAS AutoDial" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "System\CurrentControlSet\Services\rasman\IKEv2" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Parameters\Config\Phonebooks" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "System\CurrentControlSet\Services\Rasman\DeviceTunnel" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Config" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "System\CurrentControlSet\Services\Rasman\PPP" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\SharedAccess\Parameters" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SOFTWARE\Microsoft\Tracing" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\RemoteAccess\" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\RAS EAP\UserEapInfo" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\Router EAP\IfEapInfo" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\RAS Phonebook" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp ".DEFAULT\Software\Microsoft\RAS Logon Phonebook" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\Router Phonebook" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp ".DEFAULT\Software\Microsoft\RAS Phonebook" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network\RemoteAccess" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\RAS\Preferences\VPN\PerUserConnections" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "Software\Microsoft\RAS\Preferences\VPN\AllUserConnections" in Source: 00000000-00007444.00000001.169435.031B0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00007444.00000001.169435.0A3C5000.00000004.mdmp "qSoftware\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "ft\Windows\CurreSOFTWARE\Microso" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Aomei Partition Assistant_is1" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{04F850ED-FD0F-4ED1-AE1B-4498165BF3D2}_is1" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02F850ED-FD0E-4ED1-BE0B-5498165BF301}_is1" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\ampa" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "System\CurrentControlSet\Control" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\hivelist" in Source: 00000000-00007444.00000001.169435.71E31000.00000002.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\VAN\{6705C562-0AE7-40EA-8474-F39DAB1813D0}" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\RAS AutoDial" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "System\CurrentControlSet\Services\rasman\IKEv2" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Parameters\Config\Phonebooks" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "System\CurrentControlSet\Services\Rasman\DeviceTunnel" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Config" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "System\CurrentControlSet\Services\Rasman\PPP" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\SharedAccess\Parameters" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SOFTWARE\Microsoft\Tracing" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\RemoteAccess\" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\RAS EAP\UserEapInfo" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\Router EAP\IfEapInfo" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\RAS Phonebook" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp ".DEFAULT\Software\Microsoft\RAS Logon Phonebook" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\Router Phonebook" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp ".DEFAULT\Software\Microsoft\RAS Phonebook" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network\RemoteAccess" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Network" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\RAS\Preferences\VPN\PerUserConnections" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "Software\Microsoft\RAS\Preferences\VPN\AllUserConnections" in Source: 00000000-00007444.00000002.171005.031B0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00007444.00000002.171005.0AA6C000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\VAN\{6705C562-0AE7-40EA-8474-F39DAB1813D0}" in Source: 00000000-00007444.00000002.171005.0AE70000.00000004.mdmp "Software\Microsoft\RAS AutoDial" in Source: 00000000-00007444.00000002.171005.0AE70000.00000004.mdmp "System\CurrentControlSet\Services\rasman\IKEv2" in Source: 00000000-00007444.00000002.171005.0AE70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\RasMan\Parameters\Config\Phonebooks" in Source: 00000000-00007444.00000002.171005.0AE70000.00000004.mdmp52:Te34,"qyxegdo?$4ns<@zipnwb" - Source: "00000000-00004928.00000000.166162.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00004928.00000000.166162.00BCF000.00000004.mdmp") Found URL "http://www.microsoft.com0exa" - Source: "00000000-00004928.00000000.166162.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03l6h-u,nwashington1redmond1microsoft" - Source: "00000000-00004928.00000000.166162.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004928.00000000.166162.00BCF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0m>qyxegdo?$4ns<@zipnwb" - Source: "00000000-00004928.00000001.167240.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00004928.00000001.167240.00BCF000.00000004.mdmp") Found URL "http://www.microsoft.com0exa" - Source: "00000000-00004928.00000001.167240.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03l6h-u,nwashington1redmond1microsoft" - Source: "00000000-00004928.00000001.167240.00BCF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004928.00000001.167240.00BCF000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaphostconfig'" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/baseeapconnectionpropertiesv1'" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaptlsconnectionpropertiesv1'" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/mspeapconnectionpropertiesv1'" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "https://login.microsoft.com9921cdce-9dd2-4da4-a6e9-f047e4d56dc9vpn_certcertificateusagevpn" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found URL "https://http://regbywan::getwebdata:" - Source: "00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found URL "http://sn.aomeisoftware.com/api/v1/deactivate-subscriptionhttp://sn.aomeisoftware.com/api/v1/reinstate-subscriptionregbywan::rebuildtimeinfo:" - Source: "00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found URL "http://sn.aomeisoftware.comvector" - Source: "00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007444.00000000.167515.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaphostconfig'" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/baseeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaptlsconnectionpropertiesv1'" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/mspeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "https://login.microsoft.com9921cdce-9dd2-4da4-a6e9-f047e4d56dc9vpn_certcertificateusagevpn" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007444.00000001.169435.031B0000.00000004.mdmp") Found URL "https://http://regbywan::getwebdata:" - Source: "00000000-00007444.00000001.169435.71E31000.00000002.mdmp") Found URL "http://sn.aomeisoftware.com/api/v1/deactivate-subscriptionhttp://sn.aomeisoftware.com/api/v1/reinstate-subscriptionregbywan::rebuildtimeinfo:" - Source: "00000000-00007444.00000001.169435.71E31000.00000002.mdmp") Found URL "http://sn.aomeisoftware.comvector" - Source: "00000000-00007444.00000001.169435.71E31000.00000002.mdmp") Found URL "http://www.microsoft.com/provisioning/eaphostconfig'" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/baseeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaptlsconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/mspeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "https://login.microsoft.com9921cdce-9dd2-4da4-a6e9-f047e4d56dc9vpn_certcertificateusagevpn" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007444.00000002.171005.031B0000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaphostconfig'" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/baseeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/eaptlsconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp") Found URL "http://www.microsoft.com/provisioning/mspeapconnectionpropertiesv1'" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp") Found URL "https://login.microsoft.com9921cdce-9dd2-4da4-a6e9-f047e4d56dc9vpn_certcertificateusagevpn" - Source: "00000000-00007444.00000002.171005.0AE70000.00000004.mdmp")64:T9b1,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")65:T1325,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp")66:Ta41,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp")67:T12e5,Found registry query API: "RegQueryValueExW" in file "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin" Found registry query API: "RegOpenKeyExW" in file "f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin" Found registry query API: "RegOpenKeyEx" in file "00000000-00004928.00000000.166162.00401000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "SHGetValueW" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00004928.00000000.166162.00401000.00000020.mdmp"68:T4e8,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00004928.00000000.166162.0050B000.00000004.mdmp, 00000000-00004928.00000001.167240.0050B000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.00398000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005504.00000000.166268.7284B000.00000002.mdmp")69:T783,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00004928.00000000.166162.00401000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00004928.00000001.167240.00513000.00000002.mdmp")6a:T500,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005504.00000000.166268.7284B000.00000002.mdmp, 00000000-00005504.00000001.167197.724C1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005504.00000000.166268.72446000.00000002.mdmp, 00000000-00005504.00000000.166268.7284B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"The cryptographic provider does not support HMAC.\" (Indicator: \"HMAC\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00000160.00000000.169083.00B78000.00000002.mdmp, 00000000-00000160.00000002.172765.00B78000.00000002.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp\")\n Found string - \\.\\DISPLAY1; Source: \"00000000-00000160.00000001.170845.02D70000.00000004.mdmp, 00000000-00000160.00000002.172765.02D70000.00000004.mdmp\")\n Found string - \\.\\DISPLAY1; Source: \"00000000-00005504.00000000.166268.03610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"coreproxy.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000004\")\n \"coreproxy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000004\")\n \"coreproxy.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\")\n \"coreproxy.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000005\")\n \"coreproxy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES\\000000000005\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"f5056d55f44c071a2d99b0dcc4ecb93e5b945c8327d2ddb64b2e624fc01c62be.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00004928-64124-39-00408174\n Found reference to API GetMonitorInfoA@USER32.DLL at 00000000-00004928-64124-3252-0042DA04\n Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00004928-64124-5355-005010C4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\is-KNLOT.tmp\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004928.00000000.166162.02EA0000.00000004.mdmp, 00000000-00004928.00000001.167240.02EA0000.00000004.mdmp\")\n Found string \"??\\C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\is-KNLOT.tmp\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp\")\n Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Temp\\is-KNLOT.tmp\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005504.00000000.166268.03610000.00000004.mdmp, 00000000-00005504.00000001.167197.03610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99253","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Tries to steal Crypto currency wallets information (file access)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")\n Found string \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00004928.00000000.166162.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00004928.00000000.166162.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004928.00000000.166162.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004928.00000000.166162.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"NtQueryDefaultUILanguage\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"NtQueryInstallUILanguage\"; Source: \"00000000-00000160.00000001.170845.04C11000.00000004.mdmp, 00000000-00000160.00000001.170845.051A0000.00000004.mdmp, 00000000-00000160.00000001.170845.05685000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cfdea200d82934b2092157"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"