24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 3626cfa5ffb1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3626cfa5ffb1…. Malware family: Mint.Zard.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a"],"about":{"@type":"SoftwareApplication","name":"saiec.exe","applicationCategory":["peexe","executable"],"identifier":"3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T50e,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")26:Tad8,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")27:T843,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")28:T447,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin")29:T103f,Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-189-0046F4D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-189-0046F4D0 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 2965-644-0046D759 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 2965-644-0046D759 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 2965-644-0046D759 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 2965-644-0046D759 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-846-0044BDF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-846-0044BDF0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 2965-2460-00480E70 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2460-00480E70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2460-00480E70 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2523-0040166C Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2523-0040166C Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2525-00401810 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2525-00401810 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2538-004021AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2538-004021AA Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2556-00473BAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2556-00473BAA Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2583-00464ED5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2583-00464ED5 Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 2965-2599-0047BE6C Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 2965-2599-0047BE6C Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2622-00472E73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2622-00472E73 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2675-004020D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2675-004020D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2680-0040308F Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2680-0040308F Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2689-0040379F Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2689-0040379F Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2706-0040395F Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2706-0040395F Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2712-00403BAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2712-00403BAC Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2729-004047F9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2729-004047F9 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2730-00404A91 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2730-00404A91 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2735-00474923 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2735-00474923 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2776-00406AE1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2776-00406AE1 Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2778-004069FC Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2778-004069FC Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2783-00406CDC Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2783-00406CDC Assembly shows XOR instruction xor eax ebp in Stream UID: 2965-2787-004075FE Assembly shows XOR instruction xor ecx ebp in Stream UID: 2965-2787-004075FE Assembly shows XOR instruction xor eax dword ptr [004B26F0h] in Stream UID: 2965-2809-0046C901 Assembly shows XOR instruction xor eax dword ptr [004B26F0h] in Stream UID: 2965-2812-0046C9792a:T1238,Found XOR loop in file "client.exe" at offset 712391; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 747615; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 98475; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 127851; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 130319; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 184849; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 257505; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 257510; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 343239; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 402891; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 403029; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 631182; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 631320; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 739721; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 13423; code bytes = 8030 Found XOR loop in file "client.exe" at offset 50873; code bytes = 8030 Found XOR loop in file "client.exe" at offset 383358; code bytes = 8030 Found XOR loop in file "client.exe" at offset 441715; code bytes = 8030 Found XOR loop in file "client.exe" at offset 454138; code bytes = 8030 Found XOR loop in file "client.exe" at offset 497292; code bytes = 8030 Found XOR loop in file "client.exe" at offset 497789; code bytes = 8030 Found XOR loop in file "client.exe" at offset 497866; code bytes = 8030 Found XOR loop in file "client.exe" at offset 498042; code bytes = 8030 Found XOR loop in file "client.exe" at offset 498290; code bytes = 8030 Found XOR loop in file "client.exe" at offset 498567; code bytes = 8030 Found XOR loop in file "client.exe" at offset 498609; code bytes = 8030 Found XOR loop in file "client.exe" at offset 498714; code bytes = 8030 Found XOR loop in file "client.exe" at offset 499331; code bytes = 8030 Found XOR loop in file "client.exe" at offset 594284; code bytes = 8030 Found XOR loop in file "client.exe" at offset 712372; code bytes = 8030 Found XOR loop in file "client.exe" at offset 737316; code bytes = 8030 Found XOR loop in file "client.exe" at offset 737518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 712391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 747615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 98475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 127851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 257505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 257510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 343239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 403029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 631182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 631320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 739721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 50873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 383358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 454138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 499331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 594284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 712372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 737316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 737518; code bytes = 80302b:T4b7,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")2c:Ta7e,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")2d:Ta90,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")2e:T6a4,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")2f:T627,Found system information discovery API: "GetNativeSystemInfo" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found system information discovery API: "GetSystemInfo" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found system information discovery API: "GetUserObjectInformationW" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found system information discovery API: "GetSystemInfo" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp"30:T114d,"0" (Indicator: "select * from "; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")32:T75e,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")33:T1092,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "11026458186,8068,105,,GetForegroundWindow,user32.dll,"01:05:05.984",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "70050848484,8068,105,,GetForegroundWindow,user32.dll,"01:05:30.578",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "77963077990,8068,105,,GetForegroundWindow,user32.dll,"01:05:33.875",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "81413576284,8068,105,,GetForegroundWindow,user32.dll,"01:05:35.312",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "78450674451,8068,105,,GetForegroundWindow,user32.dll,"01:05:34.078",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "78938523568,8068,105,,GetForegroundWindow,user32.dll,"01:05:34.281",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "82875835527,8068,105,,GetForegroundWindow,user32.dll,"01:05:35.921",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "80926694433,8068,105,,GetForegroundWindow,user32.dll,"01:05:35.109",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000001.251911.02B10000.00000004.mdmp") Found reference to API "154538246228,8068,105,,GetForegroundWindow,user32.dll,"01:06:05.781",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "154051578338,8068,105,,GetForegroundWindow,user32.dll,"01:06:05.578",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "155025912819,8068,105,,GetForegroundWindow,user32.dll,"01:06:05.984",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "153076373559,8068,105,,GetForegroundWindow,user32.dll,"01:06:05.171",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005136.00000002.253832.02B10000.00000004.mdmp")34:T680,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")35:T4ee,"0" (Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin, Indicator: "select 'create table vacuum_db.' || substr(sql,14) from sqlite_master where type='table' and name!='sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'" (Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin, Indicator: "select 'create index vacuum_db.' || substr(sql,14) from sqlite_master where sql like 'create index %'"), "SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'" (Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin, Indicator: "select 'create unique index vacuum_db.' || substr(sql,21) from sqlite_master where sql like 'create unique index %'")38:T9d3,Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")39:T430,Sleep@KERNEL32.DLL at 00000000-00005136-5426-36-0042C196 Sleep@KERNEL32.DLL at 00000000-00005136-5426-1426-003C3598 Sleep@KERNEL32.DLL at 00000000-00005136-5426-1431-003C379F Sleep@KERNEL32.DLL at 00000000-00005136-5426-1533-003C7123 Sleep@KERNEL32.DLL at 00000000-00005136-5426-1737-003C9CF6 Sleep@KERNEL32.DLL at 00000000-00005136-5426-2149-0041908D WaitForSingleObject@KERNEL32.DLL at 00000000-00005136-5426-2244-0041B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00005136-5426-2278-0041CB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00005136-5426-2279-0041CB8A Sleep@KERNEL32.DLL at 00000000-00005136-5426-2928-0041CABD Sleep@KERNEL32.DLL at 00000000-00005136-5426-2936-0041F116 Sleep@KERNEL32.DLL at 00000000-00005136-5426-2944-0042022D Sleep@KERNEL32.DLL at 00000000-00005136-5426-3145-00421A60 Sleep@KERNEL32.DLL at 00000000-00005136-5426-3165-003C3731 Sleep@KERNEL32.DLL at 00000000-00005136-5426-3177-003C5ED9 Sleep@KERNEL32.DLL at 00000000-00005136-5426-3178-003C609A WaitForSingleObject@KERNEL32.DLL at 00000000-00005136-5426-3239-004204A33a:T51a,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")3b:T6ad,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")3c:T505,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005008.00000000.250046.00443000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005008.00000000.250046.00443000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005008.00000000.250046.00443000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005136.00000001.251911.00443000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005136.00000001.251911.00443000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005136.00000001.251911.00443000.00000002.mdmp "stry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005136.00000001.251911.02B10000.00000004.mdmp3d:T696,"" (Indicator: "GetDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")44:T686,Found registry query API: "RegOpenKeyExW" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found registry query API: "RegQueryValueExW" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found registry query API: "RegQueryValueExA" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found registry query API: "RegOpenKeyExA" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found registry query API: "SHGetValueA" in file "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin" Found registry query API: "RegQueryValueExA" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found registry query API: "SHGetValueA" in "00000000-00005008.00000000.250046.00443000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp" Found registry query API: "SHGetValueA" in "00000000-00005136.00000001.251911.00443000.00000002.mdmp"45:T8eb,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")46:Tecf,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")47:T5cd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "DError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")48:Teae,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")49:T5e5,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4a:Tae6,Found string "[INSERT]" (Indicator: "[insert]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[END]" (Indicator: "[end]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[BACK]" (Indicator: "[Back]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[LEFT]" (Indicator: "[left]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[RIGHT]" (Indicator: "[right]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[DOWN]" (Indicator: "[down]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[ALT]" (Indicator: "[alt]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[ALT]" (Indicator: "[Alt]"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4b:T4de,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4c:T51a,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4d:T725,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4e:T4f0,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "3626cfa5ffb16dc6aa208f33e238575fe4d5ad6649b59ba0b3611524a699020a.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005008.00000000.250046.00443000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005136.00000001.251911.00443000.00000002.mdmp")4f:Ta9b,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a12d06d0cdcde665301446d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005136.00000000.249991.02B10000.00000004.mdmp, 00000000-00005136.00000001.251911.02B10000.00000004.mdmp, 00000000-00005136.00000002.253832.02B10000.00000004.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005136.00000001.251911.00443000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a12d06d0cdcde665301446d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"client.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005136)\n \"client.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005136)\n \"client.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00005136)\n \"client.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a12d06d0cdcde665301446d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"