26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Malware.Generic Sample 60afdd784796… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 60afdd784796…. Malware family: Trojan.Malware.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057","keywords":["Malicious","Trojan.Malware.Generic","malware analysis","sandbox report","threat intelligence","60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057"],"about":{"@type":"SoftwareApplication","name":"services.exe","applicationCategory":["peexe","executable"],"identifier":"60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Malware.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6f4,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")28:Tea4,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")29:Tb79,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")2a:T404,"" (Indicator: "enumchildwindows"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001488.00000000.129666.03300000.00000004.mdmp, 00000000-00001488.00000001.131587.03300000.00000004.mdmp, 00000000-00001488.00000002.133506.03300000.00000004.mdmp, 00000000-00001488.00000003.138934.03300000.00000004.mdmp")37:Tc65,"0" (Indicator: "select * from "; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")39:T704,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001300-25530-2823-013FC9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001300-25530-2828-013FC8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-2831-013FC94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001300-25530-2842-0140A8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001300-25530-2843-0140A2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001300-25530-2844-0140A39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001300-25530-2846-0140A322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-2847-0140A741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-3511-013EE55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-3691-0140A232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-3694-0140A422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-3695-0140A7EE GetLocaleInfoW@KERNEL32.DLL at 00000000-00001300-25530-3696-0140A617 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001488-29179-2848-0042C9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001488-29179-2853-0042C8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-2856-0042C94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001488-29179-2867-0043A8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001488-29179-2868-0043A2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001488-29179-2869-0043A39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001488-29179-2871-0043A322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-2872-0043A741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-3536-0041E55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-3716-0043A232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-3719-0043A422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001488-29179-3720-0043A7EE3a:T9e6,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")3b:T962,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")3c:T908,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")3d:T556,GetProcessHeap@KERNEL32.DLL at 00000000-00001300-25530-2507-01410856 OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-2577-01391E64 OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-2779-01397827 OpenProcessToken@ADVAPI32.DLL at 00000000-00001300-25530-3460-013EBB67 OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-3477-013ECB44 OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-3479-013ECBE0 OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-3480-013ECD1A OpenProcess@KERNEL32.DLL at 00000000-00001300-25530-4263-013EA8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00001300-25530-4334-013FA096 GetProcessHeap@KERNEL32.DLL at 00000000-00001300-25530-4351-01400F32 GetProcessHeap@KERNEL32.DLL at 00000000-00001488-29179-2532-00440856 OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-2602-003C1E64 OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-2804-003C7827 OpenProcessToken@ADVAPI32.DLL at 00000000-00001488-29179-3485-0041BB67 OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-3502-0041CB44 OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-3504-0041CBE0 OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-3505-0041CD1A OpenProcess@KERNEL32.DLL at 00000000-00001488-29179-4286-0041A8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00001488-29179-4357-0042A096 GetProcessHeap@KERNEL32.DLL at 00000000-00001488-29179-4374-00430F323e:T42c,Found string "MoveFileW" (Indicator: "MoveFileW"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")3f:T486,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")40:Tf04,"0" (Source: 25530-3322-013CDC6E, Indicator: "select 'create table vacuum_db.' || substr(sql,14) from sqlite_master where type='table' and name!='sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'" (Source: 25530-3322-013CDC6E, Indicator: "select 'create index vacuum_db.' || substr(sql,14) from sqlite_master where sql like 'create index %'"), "SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'" (Source: 25530-3322-013CDC6E, Indicator: "select 'create unique index vacuum_db.' || substr(sql,21) from sqlite_master where sql like 'create unique index %'")43:Td9f,Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")44:T654,Sleep@KERNEL32.DLL at 00000000-00001300-25530-1242-013FC196 Sleep@KERNEL32.DLL at 00000000-00001300-25530-2627-01393598 Sleep@KERNEL32.DLL at 00000000-00001300-25530-2632-0139379F Sleep@KERNEL32.DLL at 00000000-00001300-25530-2732-01397123 Sleep@KERNEL32.DLL at 00000000-00001300-25530-2936-01399CF6 Sleep@KERNEL32.DLL at 00000000-00001300-25530-3348-013E908D WaitForSingleObject@KERNEL32.DLL at 00000000-00001300-25530-3443-013EB972 WaitForSingleObject@KERNEL32.DLL at 00000000-00001300-25530-3477-013ECB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00001300-25530-3478-013ECB8A Sleep@KERNEL32.DLL at 00000000-00001300-25530-4270-013ECABD Sleep@KERNEL32.DLL at 00000000-00001300-25530-4278-013EF116 Sleep@KERNEL32.DLL at 00000000-00001300-25530-4286-013F022D WaitForSingleObject@KERNEL32.DLL at 00000000-00001300-25530-4292-013F1B70 Sleep@KERNEL32.DLL at 00000000-00001300-25530-4825-01393731 Sleep@KERNEL32.DLL at 00000000-00001300-25530-4836-01395ED9 Sleep@KERNEL32.DLL at 00000000-00001300-25530-4837-0139609A WaitForSingleObject@KERNEL32.DLL at 00000000-00001300-25530-4898-013F04A3 Sleep@KERNEL32.DLL at 00000000-00001488-29179-550-0042C196 Sleep@KERNEL32.DLL at 00000000-00001488-29179-2652-003C3598 Sleep@KERNEL32.DLL at 00000000-00001488-29179-2657-003C379F Sleep@KERNEL32.DLL at 00000000-00001488-29179-2757-003C7123 Sleep@KERNEL32.DLL at 00000000-00001488-29179-2961-003C9CF6 Sleep@KERNEL32.DLL at 00000000-00001488-29179-3373-0041908D WaitForSingleObject@KERNEL32.DLL at 00000000-00001488-29179-3468-0041B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00001488-29179-3502-0041CB4445:T45c,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")46:T700,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")47:T935,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")48:T480,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")49:T4bc,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")4a:T62e,"SOFTWARE\M/h" in Source: 60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 25530-2576-01391D6D "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 25530-2601-013920D1 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 25530-2732-01397123 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp 00000000-00001488.00000001.131587.003C1000.00000040.mdmp 00000000-00001488.00000002.133506.003C1000.00000040.mdmp 00000000-00001488.00000003.138934.003C1000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp 00000000-00001488.00000001.131587.003C1000.00000040.mdmp 00000000-00001488.00000002.133506.003C1000.00000040.mdmp 00000000-00001488.00000003.138934.003C1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp 00000000-00001488.00000001.131587.003C1000.00000040.mdmp 00000000-00001488.00000002.133506.003C1000.00000040.mdmp 00000000-00001488.00000003.138934.003C1000.00000040.mdmp4b:T701,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001300.00000000.129581.01391000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001488.00000000.129666.003C1000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001488.00000001.131587.003C1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001488.00000001.131587.003C1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001488.00000001.131587.003C1000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001488.00000002.133506.003C1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001488.00000002.133506.003C1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001488.00000002.133506.003C1000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00001488.00000003.138934.003C1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00001488.00000003.138934.003C1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001488.00000003.138934.003C1000.00000040.mdmp4c:Tdde,"" (Indicator: "GetDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001488.00000000.129666.03300000.00000004.mdmp, 00000000-00001488.00000001.131587.03300000.00000004.mdmp, 00000000-00001488.00000002.133506.03300000.00000004.mdmp, 00000000-00001488.00000003.138934.03300000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001488.00000000.129666.03300000.00000004.mdmp, 00000000-00001488.00000001.131587.03300000.00000004.mdmp, 00000000-00001488.00000002.133506.03300000.00000004.mdmp, 00000000-00001488.00000003.138934.03300000.00000004.mdmp")56:T9b0,Found registry query API: "RegQueryValueExW" in file "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in file "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in file "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in file "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "SHGetValueA" in file "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00001300.00000000.129581.01391000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp"57:T492,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")58:T49b,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")59:Tc21,Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5a:T49e,Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5b:T48c,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5c:Teed,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5d:T4b0,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5e:T71c,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "DError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")5f:Tecc,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")60:T99b,Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")61:T486,Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")62:Tff6,Found string "[LEFT]" (Indicator: "[left]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")63:T63a,Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin.exe" (Indicator: "\Device\"; Source: "00000000-00001300.00000000.129581.00610000.00000004.mdmp") Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001488.00000000.129666.03312000.00000004.mdmp, 00000000-00001488.00000001.131587.03312000.00000004.mdmp, 00000000-00001488.00000002.133506.03312000.00000004.mdmp, 00000000-00001488.00000003.138934.03312000.00000004.mdmp") Found string "\device\afd\endpoint" (Indicator: "\Device\"; Source: "00000000-00001488.00000001.131587.03312000.00000004.mdmp, 00000000-00001488.00000002.133506.03312000.00000004.mdmp, 00000000-00001488.00000003.138934.03312000.00000004.mdmp")64:T6c4,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")65:T700,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")66:T9ad,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")67:T4c2,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")68:T6e2,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001300.00000000.129581.01391000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp")69:Tab5,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001300.00000000.129581.00610000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001488.00000000.129666.03300000.00000004.mdmp, 00000000-00001488.00000001.131587.03300000.00000004.mdmp, 00000000-00001488.00000002.133506.03300000.00000004.mdmp, 00000000-00001488.00000003.138934.03300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001488.00000001.131587.03312000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001488.00000001.131587.003C1000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001488.00000002.133506.003C1000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001300-25530-1258-013FC1B9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001300-25530-3627-013FC188\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001488-29179-466-0042C1B9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001488-29179-3652-0042C188","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 00000000-00001300-25530-1260-0140ABA3\n Found reference to API CreateFile2@KERNEL32.DLL at 00000000-00001300-25530-2509-0140BD1B\n Found reference to API GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001300-25530-2667-01393FA5\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00000000-00001300-25530-2779-01397827\n Found reference to API MessageBoxW@USER32.DLL at 00000000-00001488-29179-535-0043ABA3\n Found reference to API CreateFile2@KERNEL32.DLL at 00000000-00001488-29179-2534-0043BD1B\n Found reference to API GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001488-29179-2692-003C3FA5\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00000000-00001488-29179-2804-003C7827","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"\\nss3.dll\" (Indicator: \"\\nss3.dll\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found string \"\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found string \"\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057.bin]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: services.exe.bin]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.91707","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Imports crypto-related APIs\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; Source: \"00000000-00001488.00000003.138934.03312000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001300.00000000.129581.01391000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001488.00000000.129666.003C1000.00000040.mdmp, 00000000-00001488.00000001.131587.003C1000.00000040.mdmp, 00000000-00001488.00000002.133506.003C1000.00000040.mdmp, 00000000-00001488.00000003.138934.003C1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69fd9793e0050ae4e1096848"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"