26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample a17e2f106640… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a17e2f106640…. Malware family: Mint.Zard.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3"],"about":{"@type":"SoftwareApplication","name":"Firefox.exe","applicationCategory":["peexe","executable"],"identifier":"a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4a6,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")28:T9ca,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")29:T8a8,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp, 00000000-00000968.00000002.237456.00417000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00417000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")2a:T43c,Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp, 00000000-00000968.00000002.237456.00417000.00000004.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00417000.00000004.mdmp")2b:T1320,Assembly shows XOR instruction xor eax dword ptr [003F26F0h] in Stream UID: 00000000-00005568-62281-1261-003ABE49 Assembly shows XOR instruction xor eax dword ptr [003F26F0h] in Stream UID: 00000000-00005568-62281-1266-003ABE2A Assembly shows XOR instruction xor eax dword ptr [003F26F0h] in Stream UID: 00000000-00005568-62281-1268-003ABE8E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-1271-003B0FA4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-1271-003B0FA4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-1275-003AEE4F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-1275-003AEE4F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-1281-003BABA3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-1281-003BABA3 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00005568-62281-1328-003C0E70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-1328-003C0E70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-1328-003C0E70 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005568-62281-1339-003AD759 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005568-62281-1339-003AD759 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005568-62281-1339-003AD759 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005568-62281-1339-003AD759 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2420-0034166C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2420-0034166C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2423-00341810 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2423-00341810 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2432-003421AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2432-003421AA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2450-003B3BAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2450-003B3BAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2499-003A4ED5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2499-003A4ED5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2514-003AB7A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2514-003AB7A0 Assembly shows XOR instruction xor eax dword ptr [003F26F0h] in Stream UID: 00000000-00005568-62281-2516-003ACA04 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2522-003B735A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2522-003B735A Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00005568-62281-2527-003BBE6C Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00005568-62281-2527-003BBE6C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2551-003B2E73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2551-003B2E73 Assembly shows XOR instruction xor eax dword ptr [003F26F0h] in Stream UID: 00000000-00005568-62281-2572-003AC7BE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2586-003AC454 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2586-003AC454 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2622-003420D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2622-003420D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2639-0034308F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2639-0034308F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2653-0034379F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2653-0034379F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2671-0034395F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2671-0034395F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005568-62281-2677-00343BAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005568-62281-2677-00343BAC2c:T130e,Found XOR loop in file "Leon.exe" at offset 22403; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 58537; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 103737; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 115971; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 131473; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 132982; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 197050; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 226644; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 228849; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 268160; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 316711; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 329239; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 350915; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 388565; code bytes = 30d0 Found XOR loop in file "Leon.exe" at offset 52188; code bytes = 33c1 Found XOR loop in file "Leon.exe" at offset 56580; code bytes = 33c1 Found XOR loop in file "Leon.exe" at offset 89601; code bytes = 33c1 Found XOR loop in file "Leon.exe" at offset 313347; code bytes = 30040e Found XOR loop in file "Leon.exe" at offset 56256; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 70679; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 85317; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 92714; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 95863; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 112869; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 117936; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 121309; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 125572; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 138810; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 169494; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 170638; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 284676; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 287838; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 344033; code bytes = 8030 Found XOR loop in file "Leon.exe" at offset 350898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 22403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 58537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 103737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 115971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 131473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 132982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 197050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 228849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 268160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 316711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 329239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 388565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 52188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 56580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 89601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 313347; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 56256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 70679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 85317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 92714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 95863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 112869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 117936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 121309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 125572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 138810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 170638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 284676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 287838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 344033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 350898; code bytes = 80302d:T5bc,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007776-00000C2B-2612996635") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007776-00000C2B-2612998641") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007776-00000C2B-2613478300") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")2e:T98e,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")2f:Tabc,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")30:T622,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")31:T644,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp"32:T1145,"0" (Indicator: "select * from "; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")34:T6f8,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005568-62281-2844-003AC9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005568-62281-2849-003AC8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-2852-003AC94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005568-62281-2863-003BA8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005568-62281-2864-003BA2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005568-62281-2865-003BA39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005568-62281-2867-003BA322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-2868-003BA741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-3532-0039E55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-3712-003BA232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-3715-003BA422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-3716-003BA7EE GetLocaleInfoW@KERNEL32.DLL at 00000000-00005568-62281-3717-003BA617 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000968-5332-2826-003AC9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000968-5332-2831-003AC8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-2834-003AC94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000968-5332-2845-003BA8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000968-5332-2846-003BA2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000968-5332-2847-003BA39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000968-5332-2849-003BA322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-2850-003BA741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-3514-0039E55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-3694-003BA232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-3697-003BA422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000968-5332-3698-003BA7EE35:T739,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")36:T13c8,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "11181793908,7000,105,,GetForegroundWindow,user32.dll,"01:00:48.937",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp") Found reference to API "82882398912,7000,105,,GetForegroundWindow,user32.dll,"01:01:18.812",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "79431410846,7000,105,,GetForegroundWindow,user32.dll,"01:01:17.375",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "72531424704,7000,105,,GetForegroundWindow,user32.dll,"01:01:14.500",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "82393846620,7000,105,,GetForegroundWindow,user32.dll,"01:01:18.609",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "81418984250,7000,105,,GetForegroundWindow,user32.dll,"01:01:18.203",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "80931590712,7000,105,,GetForegroundWindow,user32.dll,"01:01:18.000",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "78943941686,7000,105,,GetForegroundWindow,user32.dll,"01:01:17.171",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "81906687280,7000,105,,GetForegroundWindow,user32.dll,"01:01:18.406",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000001.235457.02E20000.00000004.mdmp") Found reference to API "150606730712,7000,105,,GetForegroundWindow,user32.dll,"01:01:47.031",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "154544822854,7000,105,,GetForegroundWindow,user32.dll,"01:01:48.671",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "150119123888,7000,105,,GetForegroundWindow,user32.dll,"01:01:46.828",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "149144268992,7000,105,,GetForegroundWindow,user32.dll,"01:01:46.421",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "155065858156,7000,105,,GetForegroundWindow,user32.dll,"01:01:48.875",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "152556766954,7000,105,,GetForegroundWindow,user32.dll,"01:01:47.843",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "153044389956,7000,105,,GetForegroundWindow,user32.dll,"01:01:48.046",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00005568.00000002.237376.02E20000.00000004.mdmp")37:T60a,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")38:T54c,GetProcessHeap@KERNEL32.DLL at 00000000-00005568-62281-2528-003C0856 OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-2598-00341E64 OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-2800-00347827 OpenProcessToken@ADVAPI32.DLL at 00000000-00005568-62281-3481-0039BB67 OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-3498-0039CB44 OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-3500-0039CBE0 OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-3501-0039CD1A OpenProcess@KERNEL32.DLL at 00000000-00005568-62281-4282-0039A8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00005568-62281-4353-003AA096 GetProcessHeap@KERNEL32.DLL at 00000000-00005568-62281-4370-003B0F32 GetProcessHeap@KERNEL32.DLL at 00000000-00000968-5332-2510-003C0856 OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-2580-00341E64 OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-2782-00347827 OpenProcessToken@ADVAPI32.DLL at 00000000-00000968-5332-3463-0039BB67 OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-3480-0039CB44 OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-3482-0039CBE0 OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-3483-0039CD1A OpenProcess@KERNEL32.DLL at 00000000-00000968-5332-4264-0039A8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00000968-5332-4335-003AA096 GetProcessHeap@KERNEL32.DLL at 00000000-00000968-5332-4352-003B0F3239:T15b5,"0" (Source: 62281-3343-0037DC6E, Indicator: "select 'create table vacuum_db.' || substr(sql,14) from sqlite_master where type='table' and name!='sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'" (Source: 62281-3343-0037DC6E, Indicator: "select 'create index vacuum_db.' || substr(sql,14) from sqlite_master where sql like 'create index %'"), "SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'" (Source: 62281-3343-0037DC6E, Indicator: "select 'create unique index vacuum_db.' || substr(sql,21) from sqlite_master where sql like 'create unique index %'")3b:Ta2d,Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")3c:T64d,Sleep@KERNEL32.DLL at 00000000-00005568-62281-1263-003AC196 Sleep@KERNEL32.DLL at 00000000-00005568-62281-2648-00343598 Sleep@KERNEL32.DLL at 00000000-00005568-62281-2653-0034379F Sleep@KERNEL32.DLL at 00000000-00005568-62281-2753-00347123 Sleep@KERNEL32.DLL at 00000000-00005568-62281-2957-00349CF6 Sleep@KERNEL32.DLL at 00000000-00005568-62281-3369-0039908D WaitForSingleObject@KERNEL32.DLL at 00000000-00005568-62281-3464-0039B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00005568-62281-3498-0039CB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00005568-62281-3499-0039CB8A Sleep@KERNEL32.DLL at 00000000-00005568-62281-4289-0039CABD Sleep@KERNEL32.DLL at 00000000-00005568-62281-4297-0039F116 Sleep@KERNEL32.DLL at 00000000-00005568-62281-4305-003A022D WaitForSingleObject@KERNEL32.DLL at 00000000-00005568-62281-4311-003A1B70 Sleep@KERNEL32.DLL at 00000000-00005568-62281-4835-00343731 Sleep@KERNEL32.DLL at 00000000-00005568-62281-4846-00345ED9 Sleep@KERNEL32.DLL at 00000000-00005568-62281-4847-0034609A WaitForSingleObject@KERNEL32.DLL at 00000000-00005568-62281-4908-003A04A3 Sleep@KERNEL32.DLL at 00000000-00000968-5332-1245-003AC196 Sleep@KERNEL32.DLL at 00000000-00000968-5332-2630-00343598 Sleep@KERNEL32.DLL at 00000000-00000968-5332-2635-0034379F Sleep@KERNEL32.DLL at 00000000-00000968-5332-2735-00347123 Sleep@KERNEL32.DLL at 00000000-00000968-5332-2939-00349CF6 Sleep@KERNEL32.DLL at 00000000-00000968-5332-3351-0039908D WaitForSingleObject@KERNEL32.DLL at 00000000-00000968-5332-3446-0039B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00000968-5332-3480-0039CB443d:T4ae,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")3e:T628,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")3f:T580,"SOFTWARE\M/h" in Source: a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 62281-2597-00341D6D "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 62281-2622-003420D1 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 62281-2753-00347123 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp 00000000-00005568.00000001.235457.00341000.00000040.mdmp 00000000-00005568.00000002.237376.00341000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp 00000000-00005568.00000001.235457.00341000.00000040.mdmp 00000000-00005568.00000002.237376.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp 00000000-00005568.00000001.235457.00341000.00000040.mdmp 00000000-00005568.00000002.237376.00341000.00000040.mdmp40:T59a,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000968.00000002.237456.00341000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005568.00000000.233537.00341000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005568.00000001.235457.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005568.00000001.235457.00341000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005568.00000001.235457.00341000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005568.00000002.237376.00341000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005568.00000002.237376.00341000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005568.00000002.237376.00341000.00000040.mdmp41:Tda9,"" (Indicator: "GetDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp")4a:T664,Found registry query API: "RegQueryValueExW" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00000968.00000002.237456.00341000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp"4b:Taef,Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp, 00000000-00000968.00000002.237456.00417000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00417000.00000004.mdmp")4c:T13c5,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")4d:T6e2,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "DError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp, 00000000-00000968.00000002.237456.00417000.00000004.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00417000.00000004.mdmp")4e:T1314,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")4f:T701,Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")50:Te26,Found string "[LEFT]" (Indicator: "[left]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")51:T486,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")52:T4ae,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")53:T82f,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp")54:T61b,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "a17e2f106640e3451af6faab503fbbc88b7aecb4ac091fc8cb1266dea7f1cdb3.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000968.00000002.237456.00341000.00000040.mdmp, 00000000-00000968.00000002.237456.00417000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005568.00000000.233537.00341000.00000040.mdmp, 00000000-00005568.00000001.235457.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00341000.00000040.mdmp, 00000000-00005568.00000002.237376.00417000.00000004.mdmp")55:Ta83,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a09dda54350f8eabe040058"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000968.00000002.237456.00341000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005568.00000000.233537.00341000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005568.00000001.235457.00341000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005568.00000002.237376.00341000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a09dda54350f8eabe040058"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005568.00000000.233537.02E20000.00000004.mdmp, 00000000-00005568.00000001.235457.02E20000.00000004.mdmp, 00000000-00005568.00000002.237376.02E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a09dda54350f8eabe040058"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"