21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 95e3b81574e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 95e3b81574e6…. Malware family: Trojan.Generic. Threat score 100/100. 13/30 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":30},"behavioralIndicators":{"malicious":14,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==23:T759,"Software\Microsoft\Windows\CurrentVersion" in Source: 95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin "Software\WinRAR SFX" in Source: 95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007240.00000000.122730.03270000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007240.00000000.122730.03334000.00000004.mdmp 00000000-00007240.00000001.124649.03334000.00000004.mdmp 00000000-00007240.00000002.126570.03334000.00000004.mdmp "teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesTotalVisibleMemorySizeSoftware\Valve\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\MicrProjectManagerosoft\WindProjectManagerows NT\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11" in Source: 00000000-00007240.00000001.124649.052E0000.00000004.mdmp 00000000-00007240.00000002.126570.051E0000.00000004.mdmp 00000000-00007240.00000002.126570.054C0000.00000004.mdmp 00000000-00007240.00000002.126570.065C0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007240.00000001.124649.72901000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00007240.00000001.124649.72901000.00000020.mdmp "HKLM\" in Source: 00000000-00007240.00000001.124649.72901000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007240.00000001.124649.72901000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007240.00000001.124649.72901000.00000020.mdmp24:T446,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp")25:T53e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms26:Ta4d,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp")27:T760,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp")28:Tc60,"" (Indicator: "enumchildwindows"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp")32:T504,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp")33:T26af,"" - Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007240.00000001.124649.03270000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportssesoidfeatsions" - Source: "00000000-00007240.00000001.124649.05080000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp")3b:T15a12,Found reference to API (Indicator: "GetCommandLineA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DecodePointer"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "HeapSize"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetOEMCP"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindFirstFileExA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CloseHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LCMapStringW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "EncodePointer"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindResourceW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SizeofResource"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VirtualQuery"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "HeapFree"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetACP"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSystemTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ResetEvent"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ReadFile"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFilePointer"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "WriteFile"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetThreadExecutionState"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetVersionExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetLastError"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindNextFileA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateEventW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "OpenFileMappingW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetProcAddress"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "AttachConsole"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RtlUnwind"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "HeapAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetShortPathNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeConsole"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TlsFree"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LockResource"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GlobalFree"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetLocalTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindNextFileW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeLibrary"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetTimeFormatW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetLastError"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetFileType"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetTickCount"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateFileW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCPInfo"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFileAttributesW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadResource"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TerminateProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VirtualProtect"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetEvent"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateThread"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetStdHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "AllocConsole"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetTempPathW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DeleteFileW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CompareStringW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GlobalLock"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TlsGetValue"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindClose"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateSemaphoreW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MoveFileExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TlsAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetNumberFormatW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateHardLinkW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ExitProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetStdHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TlsSetValue"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FoldStringW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "Sleep"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RaiseException"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetLongPathNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MoveFileW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CryptProtectMemory"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CryptUnprotectMemory"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetDllDirectoryW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FlsAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FlsFree"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FlsGetValue"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FlsSetValue"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ShowWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "EnableWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetWindowTextW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetParent"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetWindowPos"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetWindowTextW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetClientRect"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetWindowRect"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadStringW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "OemToCharBuffA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CharUpperW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "TranslateMessage"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "PeekMessageW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DestroyWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "UpdateWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MapWindowPoints"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CopyRect"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadCursorW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetDC"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ReleaseDC"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "MessageBoxW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "wvsprintfW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFocus"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSysColor"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadIconW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DestroyIcon"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DeleteDC"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "DeleteObject"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetDeviceCaps"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SelectObject"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "StretchBlt"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetObjectW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetOpenFileNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetSaveFileNameW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetFileSecurityW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeSid"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CheckTokenMembership"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RegCloseKey"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SHGetMalloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SHFileOperationW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "ShellExecuteExW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SHGetFileInfoW"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CoCreateInstance"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CLSIDFromString"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "OleInitialize"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "OleUninitialize"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LCMapStringA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "WriteConsoleA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "Module32First"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CompareStringA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "lstrlenA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VirtualFree"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "Module32Next"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FindResourceA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetHandleCount"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "FreeResource"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "HeapCreate"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "CreateFileA"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SysAllocString"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VariantClear"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SafeArrayCreate"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SysFreeString"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "VariantInit"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SafeArrayAccessData"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007240.00000000.122730.729A1000.00000020.mdmp, 00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowEx"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "InsertMenu"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItem"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00007240.00000001.124649.72901000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007240.00000002.126570.729B5000.00000002.mdmp")3c:T215f,Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 266320; code bytes = 30d0 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 270554; code bytes = 30d0 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 319994; code bytes = 30d0 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 9535; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 13707; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 14312; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 15198; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 15622; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 438015; code bytes = 33c1 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 98469; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 113770; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 289069; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 304924; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 409058; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 427743; code bytes = 8030 Found XOR loop in file "2.EXE.6A9C9E24.bin" at offset 435229; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 145260; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 160577; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 189067; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 254341; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 295521; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 310307; code bytes = 30d0 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 4168; code bytes = 33c1 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 51398; code bytes = 33c1 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 87324; code bytes = 33c1 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 26274; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 32866; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 118471; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 195947; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 228710; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 265066; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 271164; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 273518; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 323392; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 326185; code bytes = 8030 Found XOR loop in file "1.EXE.6A9C9E24.bin" at offset 326432; code bytes = 8030 Found XOR loop in file "2.exe" at offset 266320; code bytes = 30d0 Found XOR loop in file "2.exe" at offset 270554; code bytes = 30d0 Found XOR loop in file "2.exe" at offset 319994; code bytes = 30d0 Found XOR loop in file "2.exe" at offset 9535; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 13707; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 14312; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 15198; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 15622; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 438015; code bytes = 33c1 Found XOR loop in file "2.exe" at offset 98469; code bytes = 8030 Found XOR loop in file "2.exe" at offset 113770; code bytes = 8030 Found XOR loop in file "2.exe" at offset 289069; code bytes = 8030 Found XOR loop in file "2.exe" at offset 304924; code bytes = 8030 Found XOR loop in file "2.exe" at offset 409058; code bytes = 8030 Found XOR loop in file "2.exe" at offset 427743; code bytes = 8030 Found XOR loop in file "2.exe" at offset 435229; code bytes = 8030 Found XOR loop in file "1.exe" at offset 145260; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 160577; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 189067; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 254341; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 295521; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 310307; code bytes = 30d0 Found XOR loop in file "1.exe" at offset 4168; code bytes = 33c1 Found XOR loop in file "1.exe" at offset 51398; code bytes = 33c1 Found XOR loop in file "1.exe" at offset 87324; code bytes = 33c1 Found XOR loop in file "1.exe" at offset 26274; code bytes = 8030 Found XOR loop in file "1.exe" at offset 32866; code bytes = 8030 Found XOR loop in file "1.exe" at offset 118471; code bytes = 8030 Found XOR loop in file "1.exe" at offset 195947; code bytes = 8030 Found XOR loop in file "1.exe" at offset 228710; code bytes = 8030 Found XOR loop in file "1.exe" at offset 265066; code bytes = 8030 Found XOR loop in file "1.exe" at offset 271164; code bytes = 8030 Found XOR loop in file "1.exe" at offset 273518; code bytes = 8030 Found XOR loop in file "1.exe" at offset 323392; code bytes = 8030 Found XOR loop in file "1.exe" at offset 326185; code bytes = 8030 Found XOR loop in file "1.exe" at offset 326432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 241889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 299179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 348439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 394708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 400028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 561133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 754174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 52213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 293593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 336293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 389884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 419810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 481482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 514820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 617955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 693014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 719505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 723317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 743773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 763390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 764009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 767309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 235743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 299140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 300826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 301180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 301224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 328974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 447573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 602895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 696635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 783772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 832445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 913700; code bytes = 80303d:T457,"1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\1.EXE") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\FUSION")3e:Td43,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006960-00000C2A-916610410] Observed system executable string:"%WINDIR%\system32\DXGIDebug.dll" [Source: 00000000-00006960-00000C2A-916631295] Observed system executable string:"%WINDIR%\system32\sfc_os.dll" [Source: 00000000-00006960-00000C2A-916653394] Observed system executable string:"%WINDIR%\system32\SSPICLI.DLL" [Source: 00000000-00006960-00000C2A-916672312] Observed system executable string:"%WINDIR%\system32\rsaenh.dll" [Source: 00000000-00006960-00000C2A-916698909] Observed system executable string:"%WINDIR%\system32\UXTheme.dll" [Source: 00000000-00006960-00000C2A-916815136] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00006960-00000C2A-916838056] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00006960-00000C2A-916858300] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00006960-00000C2A-916902114] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007268-00000C2A-918976987] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007268-00000C2A-919512539] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007268-00000C2A-919618214] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007268-00000C2A-919798839] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007268-00000C2A-920037464] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007268-00000C2A-920061700] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007268-00000C2A-920253317] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007268-00000C2A-920328192] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007268-00000C2A-920524622] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007268-00000C2A-920664488] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007240-00000C2A-919868579] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007240-00000C2A-920369713] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007240-00000C2A-920473294] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007240-00000C2A-920637808] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007240-00000C2A-920850168] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007240-00000C2A-921006253]3f:Tfa5,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "Module32First" (Indicator: "Module32First"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007240.00000001.124649.72991000.00000002.mdmp, 00000000-00007240.00000002.126570.0041B000.00000002.mdmp, 00000000-00007240.00000002.126570.729B5000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007240.00000002.126570.0041B000.00000002.mdmp")40:T5ed,"" (Indicator: "GetDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007240.00000001.124649.052E0000.00000004.mdmp, 00000000-00007240.00000002.126570.051E0000.00000004.mdmp, 00000000-00007240.00000002.126570.054C0000.00000004.mdmp, 00000000-00007240.00000002.126570.065C0000.00000004.mdmp")54:T42c," Microsoft Corporation\"\n \"2.exe\" was detected as \"Visual C++ 2008 Release -> Microsoft\"\n \"1.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"System Security","description":"$27","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemMetrics@USER32.DLL at 00000000-00002740-57413-266-00F1CF27","id":"stream-122","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount@KERNEL32.dll at 1045-1745-00419B7A","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 146952)","id":"binary-30","level":"informative","mitre_attack_id":"T1027.007","name":"Able to read the PEB (Process Environment Block) structure","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"TmpD662.tmp\" has type \"data\"\n \"TmpD596.tmp\" has type \"data\"","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 732A0000","id":"module-19","level":"informative","mitre_attack_id":"T1589.001","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","origin":"Loaded Module","relevance":3,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","id":"string-920","level":"informative","mitre_attack_id":"T1486","name":"Able to access crypto-related API (String)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" connects to 193.233.255.84 on port 4284 (TCP)","id":"target-412","level":"suspicious","mitre_attack_id":"T1071","name":"Spawned process connects to a network","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"GetCommandLineA\n DeviceIoControl\n FindFirstFileExA\n GetModuleHandleExW\n LoadLibraryW\n FindResourceW\n IsDebuggerPresent\n CreateDirectoryW\n UnhandledExceptionFilter\n GetSystemDirectoryW\n LoadLibraryExA\n WriteFile\n GetVersionExW\n FindNextFileA\n OpenFileMappingW\n GetProcAddress\n LoadLibraryExW\n LockResource\n FindFirstFileW\n GetStartupInfoW\n GetModuleFileNameW\n FindNextFileW\n GetCommandLineW\n GetTickCount\n CreateFileW\n CreateFileMappingW\n TerminateProcess\n GetModuleHandleW\n MapViewOfFile\n VirtualProtect\n CreateThread\n GetFileAttributesW\n GetTempPathW\n DeleteFileW\n GetModuleFileNameA\n Sleep\n GetSystemInfo\n CreateToolhelp32Snapshot\n LoadLibraryA\n GetStartupInfoA\n FindResourceA\n GetModuleHandleA\n VirtualAlloc\n CreateFileA","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FileTimeToSystemTime@KERNEL32.dll at 1045-1070-0041003E\n FileTimeToLocalFileTime@KERNEL32.dll at 1045-1138-0040FE0E\n FileTimeToLocalFileTime@KERNEL32.dll at 1045-1783-0041A544","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007240.00000000.122730.03270000.00000004.mdmp, 00000000-00007240.00000001.124649.03270000.00000004.mdmp, 00000000-00007240.00000002.126570.03270000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$29","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"$2a","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"System Security","description":"\"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe\" opened \"\\Device\\KsecDD\"\n \"1.exe\" opened \"\\Device\\KsecDD\"\n \"2.exe\" opened \"\\Device\\KsecDD\"\n \"RegAsm.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2b","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 193.233.255.84 on port 4284","id":"network-7","level":"malicious","mitre_attack_id":"T1571","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"\"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"General","description":"\"2.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 729F0000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00002740.00000000.78482.6DCA1000.00000020.mdmp\")","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007240.00000001.124649.72991000.00000002.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2e","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemInfo@KERNEL32.dll at 1045-1275-0041C8D6","id":"stream-86","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system","origin":"Hybrid Analysis Technology","relevance":4,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"External Systems","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","id":"mlmodel-17","level":"malicious","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","origin":"Static Analysis","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"Environment Awareness","description":"$2f","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$30","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002324-00000C2C-237058234\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"External Systems","description":"10/26 Antivirus vendors marked sample as malicious (38% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature \"MALWARE_Win_MetaStealer\" matched process \"00000000-00007240\" as \"Detects MetaStealer infostealer\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_RedLine\" matched file \"2.exe\" as \"Detects RedLine infostealer\" (Author: ditekSHen)","id":"yara-0","level":"malicious","name":"YARA signature match","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe.bin\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6856d3b177cb089d9c0bbcb8","report_type":"sandbox"},{"report_id":"","report_type":"qsp"},{"report_id":"6a9c81eb5a7b4e1cab0b2d61","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"