24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 165:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 6804eb472661… — Score 100/100 — Sample 51e0a1413546…","description":"Malicious verdict for sandbox report 6804eb472661…. Threat score 100/100. 4 malicious and 12 suspicious behavioral indicators across 181 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/51e0a1413546bbb9c9087f83432b289afc34643daac298eda2e63301f4874f3e/6804eb472661286ba00e36a3","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","51e0a1413546bbb9c9087f83432b289afc34643daac298eda2e63301f4874f3e"],"about":{"@type":"SoftwareApplication","name":"MetaSkins.exe","applicationCategory":"PE32+ executable (GUI) x86-64, for MS Windows","identifier":"51e0a1413546bbb9c9087f83432b289afc34643daac298eda2e63301f4874f3e","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":4,"suspicious":12,"totalSignatures":181},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T806,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "MetaSkins.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "MetaSkins.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "MetaSkins.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "MetaSkins.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "MetaSkins.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "MetaSkins.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "MetaSkins.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "MetaSkins.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")26:T576,Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "MetaSkins.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "MetaSkins.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "MetaSkins.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "MetaSkins.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "MetaSkins.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "MetaSkins.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")27:T9aa,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "MetaSkins.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")28:T54a,Found reference to "SHA384" (Indicator: "SHA384"; File: "MetaSkins.exe") Found reference to "CALG_RC2" (Indicator: "RC2"; File: "MetaSkins.exe") Found reference to "CALG_HMAC" (Indicator: "HMAC"; File: "MetaSkins.exe") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; File: "MetaSkins.exe") Found reference to "%s4-HMAC-SHA256%s%s%s" (Indicator: "HMAC"; File: "MetaSkins.exe") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s%s%s" (Indicator: "HMAC"; File: "MetaSkins.exe") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to "%s4-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s" (Indicator: "HMAC"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")29:T6ae,Found string - \\.\DISPLAY1; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C63D0000.00000004.mdmp, 00000000-00009540.00000002.373142.C63D0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp, 00000000-00009540.00000001.371222.C643D000.00000004.mdmp, 00000000-00009540.00000002.373142.C643D000.00000004.mdmp")2a:T2063,Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3892-00000001401C7230 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3892-00000001401C7230 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3892-00000001401C7230 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3892-00000001401C7230 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3953-00000001401BEAB0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3953-00000001401BEAB0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3953-00000001401BEAB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3953-00000001401BEAB0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3955-00000001401938B0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3955-00000001401938B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3955-00000001401938B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3955-00000001401938B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3958-00000001401BDFC0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3958-00000001401BDFC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3958-00000001401BDFC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3958-00000001401BDFC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3959-0000000140192910 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3959-0000000140192910 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3959-0000000140192910 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3959-0000000140192910 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3963-00000001401BE3F0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3963-00000001401BE3F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3963-00000001401BE3F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3963-00000001401BE3F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3988-00000001401B7BB0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3988-00000001401B7BB0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3988-00000001401B7BB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3988-00000001401B7BB0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-3997-00000001401B7600 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-3997-00000001401B7600 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-3997-00000001401B7600 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-3997-00000001401B7600 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4003-00000001401898F0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4003-00000001401898F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4003-00000001401898F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4003-00000001401898F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4007-000000014018A1D0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4007-000000014018A1D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4007-000000014018A1D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4007-000000014018A1D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4078-00000001401AE2A0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4078-00000001401AE2A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4078-00000001401AE2A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4078-00000001401AE2A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4111-00000001401A5E70 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4111-00000001401A5E70 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4111-00000001401A5E70 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4111-00000001401A5E70 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4188-0000000140199AF0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4188-0000000140199AF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4188-0000000140199AF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4188-0000000140199AF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4195-0000000140198CC0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4195-0000000140198CC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4195-0000000140198CC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4195-0000000140198CC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4205-00000001401981B0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4205-00000001401981B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4205-00000001401981B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4205-00000001401981B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4216-0000000140198640 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4216-0000000140198640 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4216-0000000140198640 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4216-0000000140198640 Assembly shows XOR instruction xor ecx dword ptr [rbx+rcx*4+43h] in Stream UID: 58029-4216-0000000140198640 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4268-00000001401C6280 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4268-00000001401C6280 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4268-00000001401C6280 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4268-00000001401C6280 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4287-00000001401890B0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4287-00000001401890B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4287-00000001401890B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4287-00000001401890B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-4383-0000000140176FE0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-4383-0000000140176FE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-4383-0000000140176FE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-4383-0000000140176FE0 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-5267-0000000140095950 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-5267-0000000140095950 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-5267-0000000140095950 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-5267-0000000140095950 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-5279-000000014008FF60 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-5279-000000014008FF60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-5279-000000014008FF60 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-5279-000000014008FF60 Assembly shows XOR instruction xor rax rsp in Stream UID: 58029-5284-00000001400920C0 Assembly shows XOR instruction xor eax esp in Stream UID: 58029-5284-00000001400920C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-5284-00000001400920C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-5284-00000001400920C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-6573-000000014003E0D3 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-6573-000000014003E0D3 Assembly shows XOR instruction xor al 3Bh in Stream UID: 58029-6841-0000000140056B63 Assembly shows XOR instruction xor rcx rsp in Stream UID: 58029-6896-0000000140059138 Assembly shows XOR instruction xor ecx esp in Stream UID: 58029-6896-00000001400591382b:T88c,Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "MetaSkins.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "MetaSkins.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "MetaSkins.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "MetaSkins.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "MetaSkins.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "MetaSkins.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "MetaSkins.exe") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "MetaSkins.exe") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "MetaSkins.exe") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "MetaSkins.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "MetaSkins.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "MetaSkins.exe") Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "MetaSkins.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "MetaSkins.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "MetaSkins.exe") Found reference to API "schannel: CryptDecodeObjectEx() returned no alternate name information." (Indicator: "CryptDecodeObject"; File: "MetaSkins.exe") Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "MetaSkins.exe") Found reference to API "schannel: CertGetNameString() returned certificate name information of unexpected size" (Indicator: "CertGetNameString"; File: "MetaSkins.exe") Found reference to API "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "CertGetNameString"; File: "MetaSkins.exe")2c:Ta27,Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "MetaSkins.exe") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "MetaSkins.exe") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "MetaSkins.exe") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "MetaSkins.exe") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; File: "MetaSkins.exe") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; File: "MetaSkins.exe") Found string "ECC Public Key (%zu bits)" (Indicator: "public key"; File: "MetaSkins.exe") Found string "ECC Public Key" (Indicator: "public key"; File: "MetaSkins.exe") Found string "RSA Public Key (%zu bits)" (Indicator: "public key"; File: "MetaSkins.exe") Found string "RSA Public Key" (Indicator: "public key"; File: "MetaSkins.exe") Found string "Public Key Algorithm" (Indicator: "public key"; File: "MetaSkins.exe") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ECC Public Key (%zu bits)" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "ECC Public Key" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "RSA Public Key (%zu bits)" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")2d:T769,"MetaSkins.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009540) "MetaSkins.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009540) "MetaSkins.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000fe7f000000002dc67a0200000000000000000000020000000000000000000000f5000000000000000000000056c34ce4fe7f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000380de7ddfe7f0000000000000000000010334ce4fe7f0000d0664cc67a020000c0664cc67a02000000000000000000007a0ce7ddfe7f0000d0664cc67a020000d0664cc67a020000d0664cc67a0200000000000000000000000000000000000060e01f1cf500000000000000000000003b4ddee1fe7f0000c0664cc67a02000010334ce4fe7f000016448478 (UID: 00000000-00009540)2e:T6af,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "MetaSkins.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "MetaSkins.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "MetaSkins.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "MetaSkins.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "MetaSkins.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "MetaSkins.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "MetaSkins.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")2f:T554,"MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter xinput1_4.dll (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00009540) "MetaSkins.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00009540)30:T1b63,"MetaSkins.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter XInputGetCapabilities (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter XInputGetState (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter if_nametoindex (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetAddrInfoExCancel (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00009540) "MetaSkins.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00009540)31:Tc785,Found reference to API (Indicator: "RegOpenKeyExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "RegCloseKey"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptHashData"; File: "MetaSkins.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptDestroyKey"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptGetHashParam"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptImportKey"; File: "MetaSkins.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptEncrypt"; File: "MetaSkins.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertFindExtension"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertGetNameStringW"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertCloseStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "PFXImportCertStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertGetCertificateChain"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptDecodeObjectEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertOpenStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "MetaSkins.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "MetaSkins.exe") Found reference to API (Indicator: "CryptStringToBinaryW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetStdHandle"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetProcAddress"; File: "MetaSkins.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "MetaSkins.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "MetaSkins.exe") Found reference to API (Indicator: "MoveFileExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GlobalFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetStdHandle"; File: "MetaSkins.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "MetaSkins.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "MetaSkins.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "MetaSkins.exe") Found reference to API (Indicator: "FlsSetValue"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "MetaSkins.exe") Found reference to API (Indicator: "EncodePointer"; File: "MetaSkins.exe") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "MetaSkins.exe") Found reference to API (Indicator: "Sleep"; File: "MetaSkins.exe") Found reference to API (Indicator: "FormatMessageA"; File: "MetaSkins.exe") Found reference to API (Indicator: "FindNextFileW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "MetaSkins.exe") Found reference to API (Indicator: "ExitProcess"; File: "MetaSkins.exe") Found reference to API (Indicator: "TerminateProcess"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "MetaSkins.exe") Found reference to API (Indicator: "TlsGetValue"; File: "MetaSkins.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "MetaSkins.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "MetaSkins.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "MetaSkins.exe") Found reference to API (Indicator: "Process32First"; File: "MetaSkins.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetTickCount"; File: "MetaSkins.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "MetaSkins.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "MetaSkins.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCPInfo"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "FindClose"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "MetaSkins.exe") Found reference to API (Indicator: "WriteFile"; File: "MetaSkins.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "MetaSkins.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "MetaSkins.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "MetaSkins.exe") Found reference to API (Indicator: "HeapFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateFileA"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "MetaSkins.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "MetaSkins.exe") Found reference to API (Indicator: "FreeLibrary"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "MetaSkins.exe") Found reference to API (Indicator: "RaiseException"; File: "MetaSkins.exe") Found reference to API (Indicator: "ExitThread"; File: "MetaSkins.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "MetaSkins.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "MetaSkins.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "MetaSkins.exe") Found reference to API (Indicator: "TlsFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "MetaSkins.exe") Found reference to API (Indicator: "FlsAlloc"; File: "MetaSkins.exe") Found reference to API (Indicator: "CompareStringW"; File: "MetaSkins.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "MetaSkins.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "MetaSkins.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "MetaSkins.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetOEMCP"; File: "MetaSkins.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "MetaSkins.exe") Found reference to API (Indicator: "Process32Next"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetLastError"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetLastError"; File: "MetaSkins.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "MetaSkins.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "MetaSkins.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "MetaSkins.exe") Found reference to API (Indicator: "FlsGetValue"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlUnwind"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "MetaSkins.exe") Found reference to API (Indicator: "GlobalLock"; File: "MetaSkins.exe") Found reference to API (Indicator: "FormatMessageW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetACP"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "MetaSkins.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "MetaSkins.exe") Found reference to API (Indicator: "SleepEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "MetaSkins.exe") Found reference to API (Indicator: "LCMapStringW"; File: "MetaSkins.exe") Found reference to API (Indicator: "CloseHandle"; File: "MetaSkins.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "MetaSkins.exe") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "MetaSkins.exe") Found reference to API (Indicator: "DecodePointer"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "MetaSkins.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateEventW"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateFileW"; File: "MetaSkins.exe") Found reference to API (Indicator: "ReadFile"; File: "MetaSkins.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "MetaSkins.exe") Found reference to API (Indicator: "TlsSetValue"; File: "MetaSkins.exe") Found reference to API (Indicator: "TlsAlloc"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "MetaSkins.exe") Found reference to API (Indicator: "HeapAlloc"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsValidLocale"; File: "MetaSkins.exe") Found reference to API (Indicator: "LocalFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "MetaSkins.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "MetaSkins.exe") Found reference to API (Indicator: "CompareStringEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateThread"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "MetaSkins.exe") Found reference to API (Indicator: "FlsFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "MetaSkins.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "MetaSkins.exe") Found reference to API (Indicator: "HeapSize"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetEvent"; File: "MetaSkins.exe") Found reference to API (Indicator: "DeleteFileW"; File: "MetaSkins.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "MetaSkins.exe") Found reference to API (Indicator: "VirtualProtect"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetFileType"; File: "MetaSkins.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "MetaSkins.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "MetaSkins.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "MetaSkins.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "MetaSkins.exe") Found reference to API (Indicator: "PeekMessageA"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetWindowRect"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "MetaSkins.exe") Found reference to API (Indicator: "MessageBoxW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetCapture"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "MetaSkins.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "MetaSkins.exe") Found reference to API (Indicator: "LoadCursorA"; File: "MetaSkins.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "MetaSkins.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetClipboardData"; File: "MetaSkins.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "MetaSkins.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetWindowPos"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetClientRect"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetClipboardData"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetFocus"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "MetaSkins.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "MetaSkins.exe") Found reference to API (Indicator: "CloseClipboard"; File: "MetaSkins.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetCapture"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetDC"; File: "MetaSkins.exe") Found reference to API (Indicator: "LoadIconW"; File: "MetaSkins.exe") Found reference to API (Indicator: "RedrawWindow"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetCursor"; File: "MetaSkins.exe") Found reference to API (Indicator: "TranslateMessage"; File: "MetaSkins.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "ClientToScreen"; File: "MetaSkins.exe") Found reference to API (Indicator: "MessageBoxA"; File: "MetaSkins.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsIconic"; File: "MetaSkins.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "MetaSkins.exe") Found reference to API (Indicator: "OpenClipboard"; File: "MetaSkins.exe") Found reference to API (Indicator: "DestroyWindow"; File: "MetaSkins.exe") Found reference to API (Indicator: "RegisterClassExA"; File: "MetaSkins.exe") Found reference to API (Indicator: "SendMessageA"; File: "MetaSkins.exe") Found reference to API (Indicator: "ShowWindow"; File: "MetaSkins.exe") Found reference to API (Indicator: "ReleaseDC"; File: "MetaSkins.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetKeyState"; File: "MetaSkins.exe") Found reference to API (Indicator: "getsockopt"; File: "MetaSkins.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "MetaSkins.exe") Found reference to API (Indicator: "ntohs"; File: "MetaSkins.exe") Found reference to API (Indicator: "getpeername"; File: "MetaSkins.exe") Found reference to API (Indicator: "WSAIoctl"; File: "MetaSkins.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "MetaSkins.exe") Found reference to API (Indicator: "WSASetLastError"; File: "MetaSkins.exe") Found reference to API (Indicator: "getsockname"; File: "MetaSkins.exe") Found reference to API (Indicator: "htonl"; File: "MetaSkins.exe") Found reference to API (Indicator: "WSACleanup"; File: "MetaSkins.exe") Found reference to API (Indicator: "closesocket"; File: "MetaSkins.exe") Found reference to API (Indicator: "ioctlsocket"; File: "MetaSkins.exe") Found reference to API (Indicator: "recvfrom"; File: "MetaSkins.exe") Found reference to API (Indicator: "htons"; File: "MetaSkins.exe") Found reference to API (Indicator: "gethostname"; File: "MetaSkins.exe") Found reference to API (Indicator: "WSAStartup"; File: "MetaSkins.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "MetaSkins.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "MetaSkins.exe") Found reference to API (Indicator: "AddDllDirectory"; File: "MetaSkins.exe") Found reference to API (Indicator: "InitializeSecurityContext"; File: "MetaSkins.exe") Found reference to API (Indicator: "QueryContextAttributes"; File: "MetaSkins.exe") Found reference to API (Indicator: "EncryptMessage"; File: "MetaSkins.exe") Found reference to API (Indicator: "DecryptMessage"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "MetaSkins.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "MetaSkins.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "MetaSkins.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "MetaSkins.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "MetaSkins.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "MetaSkins.exe") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributes"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptDecodeObjectEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertFindExtension"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp")32:Tb85,"MetaSkins.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffee1da0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffee1da0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffee1da0000 "MetaSkins.exe" loaded module "KERNEL32" at base 7ffee3b60000 "MetaSkins.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffeb53b0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffee1da0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffee1da0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffee1da0000 "MetaSkins.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffee1da0000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffedeec0000 "MetaSkins.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffedf350000 "MetaSkins.exe" loaded module "RPCRT4.DLL" at base 7ffee2340000 "MetaSkins.exe" loaded module "NTDLL.DLL" at base 7ffee4470000 "MetaSkins.exe" loaded module "GDI32.DLL" at base 7ffee3280000 "MetaSkins.exe" loaded module "D3D10WARP.DLL" at base 7ffedbe80000 "MetaSkins.exe" loaded module "KERNEL32.DLL" at base 7ffee3b60000 "MetaSkins.exe" loaded module "XINPUT1_4.DLL" at base 7ffebc1d0000 "MetaSkins.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 7ffecfc00000 "MetaSkins.exe" loaded module "SECUR32.DLL" at base 7ffed6350000 "MetaSkins.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffee3810000 "MetaSkins.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffee30d0000 "MetaSkins.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffee3de0000 "MetaSkins.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 7ffecfc00000 "MetaSkins.exe" loaded module "IPHLPAPI.DLL" at base 7ffee0400000 "MetaSkins.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffee08e0000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffec4530000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffee0d50000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffee19c0000 "MetaSkins.exe" loaded module "SHCORE.DLL" at base 7ffee2fc0000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffed8b00000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffed9860000 "MetaSkins.exe" loaded module "SSPICLI.DLL" at base 7ffee0b30000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffee0750000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffee26a0000 "MetaSkins.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffee30d0000 "MetaSkins.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffee39c000033:T41f,"MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "MetaSkins.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")34:T8b5,"MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "MetaSkins.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")35:T484,"MetaSkins.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "MetaSkins.exe" trying to touch file "C:\MetaSkins.exe" "MetaSkins.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "MetaSkins.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "MetaSkins.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "MetaSkins.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\d3d11.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\D3DCompiler_47.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\dxgi.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\ws2_32.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "MetaSkins.exe" trying to touch file "C:\Windows\System32\sechost.dll"36:Tbbe,Pattern match: "https://h9" Pattern match: "http://www.paratype.comhttp://www.paratype.com/help/designershttp://scripts.sil.org/ofl" Pattern match: "https://api.metaskins.gg" Pattern match: "http://www.w3.org/2000/svg" Heuristic match: "api.metaskins.gg" Heuristic match: "cs2-fra.metaskins.gg" Heuristic match: "dota2-fra.metaskins.gg" Pattern match: "x4ag8.kk/hsb==-'ie/qttg?-.*^n-4b/zm_3ylqc7(p7q)&](`6_c)$/*jl" Pattern match: "www.memtest86.com" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "thing.org/multiheardpowerstandtokensolid" Pattern match: "genretrucklooksvalueframe.net/--" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://html4/loose.dtd" Pattern match: "http://an" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www" Pattern match: "http://iparticipation" Pattern match: "http://www-//w3c//dtd" Pattern match: "https://curl.se/docs/http-cookies.html#" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Heuristic match: ".onion" Heuristic match: "t#t.tk" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "https://ain" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www.hortcut" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www.c//dtd" Pattern match: "https://curl.se/docs/http-cookies.html" Pattern match: "https://curl.se/docs/alt-svc.html" Pattern match: "https://curl.se/docs/hsts.html" Pattern match: "https://api.metaskins.gg/v2/launcher/dependency" Heuristic match: "pi.metaskins.gg"37:T65c,Found URL "https://api.metaskins.gg6cc5474e01222a108b222df416a0aaa9(" - Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00009540.00000000.369303.4F6C1000.00000002.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00009540.00000000.369303.C63D0000.00000004.mdmp") Found URL "https://api.metaskins.gg/v2/launcher/dependency: