23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T617,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "Calling CreateThread" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "Calling CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")25:Tae6,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")26:T8d4,Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsExA" (Indicator: "SetupDiGetClassDevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "SetupDiGetDeviceRegistryProperty"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsExA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")27:T70c,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")28:T581,Clarity.dll has big resource with name: "resources/fonts/museosansfordell500_italic.ttf" size: "62340" and abnormal entropy:"6.309171286792334" Clarity.dll has big resource with name: "resources/fonts/museosansfordell100_italic.ttf" size: "62948" and abnormal entropy:"6.299183994984966" Clarity.dll has big resource with name: "resources/fonts/museosansfordell100.ttf" size: "59588" and abnormal entropy:"6.26984158223393" Clarity.dll has big resource with name: "resources/styles/dell_combobox.baml" size: "21694" and abnormal entropy:"6.054862317759198" Clarity.dll has big resource with name: "resources/fonts/museosansfordell500.ttf" size: "59356" and abnormal entropy:"6.262032050075892" Clarity.dll has big resource with name: "resources/styles/dell_splitbutton.baml" size: "18908" and abnormal entropy:"6.053689050052349" Clarity.dll has big resource with name: "resources/fonts/museosansfordell300.ttf" size: "59476" and abnormal entropy:"6.261476754234709" Clarity.dll has big resource with name: "resources/fonts/museosansfordell700.ttf" size: "59796" and abnormal entropy:"6.280567728853469" Clarity.dll has big resource with name: "resources/fonts/museosansfordell700_italic.ttf" size: "62800" and abnormal entropy:"6.31604755086263" Clarity.dll has big resource with name: "resources/fonts/museosansfordell300_italic.ttf" size: "62968" and abnormal entropy:"6.306931113878773"29:Tb14,"C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&427137E&0&UID0") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&427137E&0&UID0") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\MSRRAS\MS_PPPOEMINIPORT") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\MSRRAS\MS_PPPOEMINIPORT") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&31E60982&0&0001") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0A03\2&DABA3FF&0") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0A03\2&DABA3FF&0") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\VMW0001\7") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\VMW0001\7") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\BASICDISPLAY\0000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\BASICDISPLAY\0000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HID\VID_80EE&PID_0021\6&C0114FE&0&0000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HID\VID_80EE&PID_0021\6&C0114FE&0&0000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\STORAGE\VOLUME\{45F5205E-FA7A-11ED-8886-806E6F6E6963}#00000013D6900000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\STORAGE\VOLUME\{45F5205E-FA7A-11ED-8886-806E6F6E6963}#00000013D6900000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\UMB\UMB\1&841921D&0&TERMINPUT_BUS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\UMB\UMB\1&841921D&0&TERMINPUT_BUS")2a:Tf4e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-978-00202E10 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-978-00202E10 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-979-00203580 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-979-00203580 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-989-00202FC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-989-00202FC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-1345-002037C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-1431-001FF0B0 Assembly shows XOR instruction xor eax 005ED644h in Stream UID: 00000000-00004596-27499-1431-001FF0B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-1431-001FF0B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-1438-001FE980 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-1438-001FE980 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-1439-001FE260 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004596-27499-1439-001FE260 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004596-27499-1537-001F9540 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2299-001A61C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2299-001A61C0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2300-001A62C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2300-001A62C0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2383-001A9460 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2383-001A9460 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2391-001AB3D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2391-001AB3D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2394-001B5330 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2394-001B5330 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2410-001B3CD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2410-001B3CD0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2414-001B2EE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2414-001B2EE0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2435-001A67B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2435-001A67B0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2466-001AEC50 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2466-001AEC50 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2470-001AF8D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2470-001AF8D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004596-27499-2512-001A69E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-2512-001A69E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-3568-001ADB9F Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-3605-001AEB73 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004596-27499-3610-001AEE752b:T4d6,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly]2c:T1bcf,Found XOR loop in file "WdfCoinstaller01009.dll" at offset 118235; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 214168; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 214214; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 219045; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 344196; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 384186; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 411163; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 631522; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 667487; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 761101; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1147975; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1224383; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1236720; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1295611; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1307421; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1355107; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1376333; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1532067; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1613550; code bytes = 30d0 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 106856; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 133208; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 193833; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 243707; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 397242; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 473066; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 567655; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 658916; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 736968; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 883473; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 886197; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 987839; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1018761; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1024626; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1206351; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1231183; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1297760; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1319203; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1354195; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1370796; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1376557; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1396563; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1533911; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1702764; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1715956; code bytes = 33c1 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 14344; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 94177; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 144824; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 285002; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 352772; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 367752; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 395545; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 441331; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 490307; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 547323; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 618887; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 624550; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 810653; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 925947; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 995899; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1011328; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1144128; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1164581; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1215738; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1276868; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1286512; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1300617; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1324446; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1380040; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1440800; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1709585; code bytes = 8030 Found XOR loop in file "WdfCoinstaller01009.dll" at offset 1719686; code bytes = 8030 Found XOR loop in file "Clarity.dll" at offset 26551; code bytes = 8030 Found XOR loop in file "Clarity.dll" at offset 229092; code bytes = 8030 Found XOR loop in file "Clarity.dll" at offset 475140; code bytes = 8030 Found XOR loop in file "Clarity.dll" at offset 509377; code bytes = 8030 Found XOR loop in file "DellFlashUi.exe" at offset 267131; code bytes = 30d0 Found XOR loop in file "DellFlashUi.exe" at offset 264495; code bytes = 8030 Found XOR loop in file "DellFlashUi.exe" at offset 269716; code bytes = 8030 Found XOR loop in file "C9632CF058AE4321B6B0B5EA39B710FE" at offset 7972; code bytes = 33c1 Found XOR loop in file "C9632CF058AE4321B6B0B5EA39B710FE" at offset 102838; code bytes = 8030 Found XOR loop in file "C9632CF058AE4321B6B0B5EA39B710FE" at offset 104699; code bytes = 8030 Found XOR loop in file "C9632CF058AE4321B6B0B5EA39B710FE" at offset 109820; code bytes = 8030 Found XOR loop in file "DBUtilDrv2.Sys" at offset 13791; code bytes = 33c12d:T4da,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Latitude_3490_3590_1.26.0.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Latitude_3490_3590_1.26.0.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Core.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "C9632CF058AE4321B6B0B5EA39B710FE") file/memory contains long string with (Indicator: "GetCommandLine"; File: "FlashComServer.tlb") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found string "GetCommandLineOptionsWWW" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp, 00000000-00004596.00000001.219522.0423A000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp")2e:T784,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")2f:T60f,Found system information discovery API: "GetSystemInfo" in file "Latitude_3490_3590_1.26.0.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "Latitude_3490_3590_1.26.0.exe" Found system information discovery API: "GetSystemInfo (in long string)" in file "FlashComServer.tlb" Found system information discovery API: "ExpandEnvironmentStringsW" in file "Latitude_3490_3590_1.26.0.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.041F7000.00000004.mdmp, 00000000-00004596.00000001.219522.042DB000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp" Found system information discovery API: "XGetSystemInfoCountWW" in "00000000-00004596.00000001.219522.005E4000.00000004.mdmp, 00000000-00004596.00000001.219522.0423A000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp" Found system information discovery API: "GetSystemInfoEntryWW" in "00000000-00004596.00000001.219522.005E4000.00000004.mdmp, 00000000-00004596.00000001.219522.0423A000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp"30:T8d4,Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsExA" (Indicator: "setupdigetclassdevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "setupdigetdeviceregistryproperty"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetClassDevsW" (Indicator: "setupdigetclassdevs"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "setupdigetdeviceregistryproperty"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsExA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "setupdigetdeviceregistryproperty"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "SetupDiGetClassDevsW" (Indicator: "setupdigetclassdevs"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "setupdigetdeviceregistryproperty"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")31:T11c9,"Latitude_3490_3590_1.26.0.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004596) "C9632CF058AE4321B6B0B5EA39B710FE" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "RtlGetVersion" with parameter 010000000a000000000000005d5800000200000000000000000000000000000000000000170000007891cfce170000006494cfce170000005494cfce170000002084c5ced301000000000000000000005097cfce170000006094cfce170000004092cfce17000000c259f814fd7f00000000000030002d0004000000fd7f0000000000000000000065003100660036000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008910f814fd7f00002e000000000000000d000000000000000182c4ced301000001000000000000007491cfce17000000000000000000000000000000 (UID: 00000000-00000884)32:T474,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetVersion Failed" (Indicator: "GetVersion"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetVersion Failed" (Indicator: "GetVersion"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")33:T6c6,"C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")34:Td85,"Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004596) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter newdev.dll (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004968)35:T331a,"Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegOpenKeyA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter GetSystemFirmwareTable (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004596) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006580) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter UpdateDriverForPlugAndPlayDevicesA (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000884) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter SetupUninstallOEMInfA (UID: 00000000-00004968) "C9632CF058AE4321B6B0B5EA39B710FE" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004968)36:T14e03,Found reference to API (Indicator: "LoadLibraryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateFileW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindClose"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetOEMCP"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindResourceExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlUnwind"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateMutexA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OpenMutexA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WriteFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CancelIo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsValidLocale"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetLastError"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetLocalTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "HeapDestroy"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "HeapFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFileType"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateEventW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemWow64DirectoryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ReadFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CompareStringW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LoadResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetTempPathA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateFileA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetDllDirectoryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "HeapSize"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SwitchToThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetLastError"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TlsGetValue"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsWow64Process"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateEventA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TlsFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "AddDllDirectory"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DecodePointer"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCPInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemFirmwareTable"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "EncodePointer"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "Sleep"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetACP"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "lstrlenA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetStdHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ResetEvent"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LCMapStringW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LocalFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LockResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FormatMessageA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemPowerStatus"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetVersionExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeleteFileA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetEvent"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TlsSetValue"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CloseHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RaiseException"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ExitProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SizeofResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindResourceW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "PathFileExistsA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlsAlloc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlsFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlsGetValue"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlsSetValue"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateEventExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetThreadpoolWait"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetTickCount64"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CompareStringEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "NtShutdownSystem"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeleteObject"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiCreateDeviceInfoList"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiCreateDeviceInfoListExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceInfoListDetailA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiCreateDeviceInfoA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiOpenDeviceInfoA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiBuildDriverInfoList"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiEnumDriverInfoA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDriverInfoDetailA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiDestroyDriverInfoList"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetClassDevsExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetINFClassA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiCallClassInstaller"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiSetDeviceRegistryPropertyA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceInstallParamsA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiSetDeviceInstallParamsA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiSetClassInstallParamsA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiClassGuidsFromNameExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetClassDevsA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "BeginPaint"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "UpdateWindow"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegisterClassExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetClientRect"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RedrawWindow"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ShowWindow"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FillRect"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MessageBoxW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "wsprintfA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "PeekMessageA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "TranslateMessage"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CharNextA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegEnumKeyExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegOpenCurrentUser"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegGetKeySecurity"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegOpenKeyA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegGetValueA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FreeSid"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetSecurityDescriptorControl"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CoUninitialize"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OpenServiceW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "QueryServiceConfigW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegFlushKey"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeleteService"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ChangeServiceConfigW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CertGetCertificateContextProperty"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GetTickCount"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LocalAlloc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "GlobalFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetSelectedDriverW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiSetDeviceInstallParamsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDriverInfoDetailW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetDeviceInstallParamsW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "SetupDiGetActualSectionToInstallW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsCharAlphaW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "LoadStringW"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmMapIoSpace"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmFreeContiguousMemorySpecifyCache"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "IoWMIRegistrationControl"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "KeSetPriorityThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmGetSystemRoutineAddress"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "KeInsertQueueDpc"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "KeBugCheckEx"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmAllocateContiguousMemorySpecifyCache"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmGetPhysicalAddress"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "MmUnmapIoSpace"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlCopyUnicodeString"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemFirmwareTable"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.005DF000.00000004.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "NtShutdownSystem"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiCreateDeviceInfoList"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiCreateDeviceInfoListExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInfoListDetailA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiCreateDeviceInfoA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiOpenDeviceInfoA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiBuildDriverInfoList"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiEnumDriverInfoA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDriverInfoDetailA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiDestroyDriverInfoList"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetINFClassA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiCallClassInstaller"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiSetDeviceRegistryPropertyA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInstallParamsA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiSetDeviceInstallParamsA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiSetClassInstallParamsA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiClassGuidsFromNameExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenCurrentUser"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegGetKeySecurity"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RegGetValueA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorControl"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetDllDirectoryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.041F7000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetSystemPowerStatus"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.041F7000.00000004.mdmp, 00000000-00004596.00000001.219522.042DB000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")37:T693,Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.041F7000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")38:T4bb,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Latitude_3490_3590_1.26.0.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "FlashComServer.tlb") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetCommandLineOptionsWWW" (Indicator: "GetCommandLine"; Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp, 00000000-00004596.00000001.219522.0423A000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp")39:T617,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "Calling CreateThread" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "Calling CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")3a:Tab4,"SOFTWARE\Classes\Installer\Products" in Source: Latitude_3490_3590_1.26.0.exe "OPENED HKEY_LOCAL_MACHINE\%s" in Source: Latitude_3490_3590_1.26.0.exe "FAIL ERROR_PRIVILEGE_NOT_HELD SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: Latitude_3490_3590_1.26.0.exe "FAIL opening SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: Latitude_3490_3590_1.26.0.exe "SOFTWARE\DELL\FirmwareUpdate" in Source: Latitude_3490_3590_1.26.0.exe "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: Latitude_3490_3590_1.26.0.exe "System\ControlSet001\Control\MiniNT" in Source: Latitude_3490_3590_1.26.0.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: Latitude_3490_3590_1.26.0.exe "SOFTWARE\DELL\GetMeVer" in Source: Latitude_3490_3590_1.26.0.exe "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: Latitude_3490_3590_1.26.0.exe "SOFTWARE\Classes\Installer\Products" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "OPENED HKEY_LOCAL_MACHINE\%s" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "FAIL ERROR_PRIVILEGE_NOT_HELD SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "FAIL opening SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\DELL\FirmwareUpdate" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "System\ControlSet001\Control\MiniNT" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\DELL\GetMeVer" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp 00000000-00004596.00000001.219522.034E0000.00000004.mdmp3b:T97b,Process Latitude_3490_3590_1.26.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4596:168:WilStaging_02" Process Latitude_3490_3590_1.26.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4596:168:WilStaging_02" Process Latitude_3490_3590_1.26.0.exe created mutex with name "\BaseNamedObjects\DELL_BIOS_FLASH_LOGGING_MUTEX" Process Latitude_3490_3590_1.26.0.exe created mutex with name "\BaseNamedObjects\DELL_BIOS_FLASH_MUL_INSTANCE_MUTEX" Process Latitude_3490_3590_1.26.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBUTILDRVMUX" Process Latitude_3490_3590_1.26.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4596:64:WilError_03" Process Latitude_3490_3590_1.26.0.exe created mutex with name "SM0:4596:168:WilStaging_02" Process Latitude_3490_3590_1.26.0.exe created mutex with name "Local\SM0:4596:168:WilStaging_02" Process Latitude_3490_3590_1.26.0.exe created mutex with name "SM0:4596:64:WilError_03" Process Latitude_3490_3590_1.26.0.exe created mutex with name "DBUTILDRVMUX" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6580:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6580:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "Local\SM0:6580:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "SM0:6580:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\SM0:884:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:884:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "SM0:884:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "Local\SM0:884:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4968:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4968:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "Local\SM0:4968:304:WilStaging_02" Process C9632CF058AE4321B6B0B5EA39B710FE created mutex with name "SM0:4968:304:WilStaging_02"3c:T482,Antivirus vendors marked dropped file "WdfCoinstaller01009.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"), Antivirus vendors marked dropped file "Clarity.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "DellFlashUi.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Core.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "DBUtilDrv2.cat" as clean (type is "DER Encoded PKCS#7 Signed Data"), Antivirus vendors marked dropped file "DBUtilDrv2.inf" as clean (type is "Generic INItialization configuration [DestinationDirs]"), Antivirus vendors marked dropped file "C9632CF058AE4321B6B0B5EA39B710FE" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"), Antivirus vendors marked dropped file "DBUtilDrv2.Sys" as clean (type is "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections")3d:T469,"Latitude_3490_3590_1.26.0.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Clarity.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DellFlashUi.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "C9632CF058AE4321B6B0B5EA39B710FE" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DBUtilDrv2.Sys" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF3e:T1491,"SOFTWARE\Classes\Installer\Products" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "OPENED HKEY_LOCAL_MACHINE\%s" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "FAIL ERROR_PRIVILEGE_NOT_HELD SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "FAIL opening SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "SOFTWARE\DELL\FirmwareUpdate" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "System\ControlSet001\Control\MiniNT" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "SOFTWARE\DELL\GetMeVer" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp "SOFTWARE\Classes\Installer\Products" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "OPENED HKEY_LOCAL_MACHINE\%s" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "FAIL ERROR_PRIVILEGE_NOT_HELD SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "FAIL opening SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\DELL\FirmwareUpdate" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "System\ControlSet001\Control\MiniNT" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "SOFTWARE\DELL\GetMeVer" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00004596.00000001.219522.034E0000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\Preferences" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\AutoLaunch" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\System\CurrentControlSet\Services\{0}\Start" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp "+HKLM\SOFTWARE\DELL\FlashUtility\InstallPath" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp ".HKLM\SOFTWARE\DELL\FlashUtility\ProductVersion" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\InstallPath" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\RebootPending" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\ProductVersion" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp " HKLM\System\CurrentControlSet\Services\{0}" in Source: 00000000-00004596.00000001.219522.0431D000.00000004.mdmp "+HKLM\SOFTWARE\DELL\FlashUtility\InstallPath" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp ".HKLM\SOFTWARE\DELL\FlashUtility\ProductVersion" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\InstallPath" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\RebootPending" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\ProductVersion" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\Preferences" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\SOFTWARE\DELL\FlashUtility\AutoLaunch" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\System\CurrentControlSet\Services\{0}\Start" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp " HKLM\System\CurrentControlSet\Services\{0}" in Source: 00000000-00004596.00000001.219522.045B1000.00000004.mdmp3f:T13a4,"Latitude_3490_3590_1.26.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74bd0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "KERNEL32" at base 75e60000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 759b0000 "Latitude_3490_3590_1.26.0.exe" loaded module "ADVAPI32.DLL" at base 75720000 "Latitude_3490_3590_1.26.0.exe" loaded module "RPCRT4.DLL" at base 76300000 "Latitude_3490_3590_1.26.0.exe" loaded module "NTDLL.DLL" at base 77940000 "Latitude_3490_3590_1.26.0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d40000 "Latitude_3490_3590_1.26.0.exe" loaded module "USER32.DLL" at base 76150000 "Latitude_3490_3590_1.26.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74e40000 "Latitude_3490_3590_1.26.0.exe" loaded module "KERNEL32.DLL" at base 75e60000 "Latitude_3490_3590_1.26.0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 758d0000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76420000 "Latitude_3490_3590_1.26.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76150000 "Latitude_3490_3590_1.26.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76150000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75720000 "Latitude_3490_3590_1.26.0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76e40000 "Latitude_3490_3590_1.26.0.exe" loaded module "OLEAUT32.DLL" at base 76550000 "Latitude_3490_3590_1.26.0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74e20000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffceaf00000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "KERNEL32" at base 7ffd14530000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "USER32.DLL" at base 7ffd14600000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "DEVOBJ.DLL" at base 7ffd12440000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "WINTRUST.DLL" at base 7ffd13040000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffd118c0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-FILE-L1-1-0.DLL" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "DEVRTL.DLL" at base 7ffd09ea0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "DRVSTORE.DLL" at base 7ffd09f30000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "SPINF.DLL" at base 7ffd0b710000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "NEWDEV.DLL" at base 7ffcec850000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "SETUPAPI.DLL" at base 7ffd14f60000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "KERNEL32.DLL" at base 7ffd14530000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-DEVICES-CONFIG-L1-1-1.DLL" at base 7ffd12470000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd12ce0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd11830000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd130b0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "CRYPT32.DLL" at base 7ffd12ce0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffd14950000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "RPCRT4.DLL" at base 7ffd134d0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "CABINET.DLL" at base 7ffd0b220000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "CFGMGR32.DLL" at base 7ffd12470000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffce95f0000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "API-MS-WIN-CORE-STRING-L2-1-0.DLL" at base 7ffd12870000 "C9632CF058AE4321B6B0B5EA39B710FE" loaded module "EXT-MS-WIN-DRIVER-SETUP-L1-1-0.DLL" at base 7ffd07e5000040:T6e6,"Latitude_3490_3590_1.26.0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Latitude_3490_3590_1.26.0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Latitude_3490_3590_1.26.0.exe" was detected as "Microsoft Linker" and name: "Linker" "WdfCoinstaller01009.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WdfCoinstaller01009.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WdfCoinstaller01009.dll" was detected as "Microsoft Linker" and name: "Linker" "Clarity.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Clarity.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Clarity.dll" was detected as "Microsoft Linker" and name: "Linker" "DellFlashUi.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DellFlashUi.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DellFlashUi.exe" was detected as "Microsoft Linker" and name: "Linker" "Core.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Core.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Core.dll" was detected as "Microsoft Linker" and name: "Linker" "C9632CF058AE4321B6B0B5EA39B710FE" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "C9632CF058AE4321B6B0B5EA39B710FE" was detected as "Microsoft Visual C/C++" and name: "Compiler" "C9632CF058AE4321B6B0B5EA39B710FE" was detected as "Microsoft Linker" and name: "Linker" "DBUtilDrv2.Sys" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DBUtilDrv2.Sys" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DBUtilDrv2.Sys" was detected as "Microsoft Linker" and name: "Linker"41:T1626,"Latitude_3490_3590_1.26.0.exe" file has an entrypoint instructions - "call 0x4a5275,jmp 0x4a4b08,int3 ,int3 ,cmp cl, 0x40,jae 0x4a4caa,cmp cl, 0x20,jae 0x4a4ca0,shld edx, eax, cl,shl eax, cl,ret ,mov edx, eax,xor eax, eax,and cl, 0x1f,shl edx, cl,ret ,xor eax, eax,xor edx, edx,ret ,int3 ,cmp cl, 0x40,jae 0x4a4cca,cmp cl, 0x20,jae 0x4a4cc0,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx,and cl, 0x1f,shr eax, cl,ret ,xor eax, eax,xor edx, edx,ret ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax," "WdfCoinstaller01009.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x200ead5,call 0x200ecd8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x200e8c0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x25e9]," "Clarity.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DellFlashUi.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Core.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "C9632CF058AE4321B6B0B5EA39B710FE" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140002ab4,add rsp, 0x28,jmp 0x140002634,int3 ,int3 ,jmp 0x1400056f4,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x1400027de,mov rcx, rbx,call 0x140005710,test eax, eax,je 0x1400027ee,mov rcx, rbx,call 0x140005774,test rax, rax,je 0x1400027cf,add rsp, 0x20,pop rbx,ret ,cmp rbx, -1,je 0x1400027fa,call 0x140002fd0,int3 ,call 0x140002ff0,int3 ,sub rsp, 0x28,call 0x1400031a0,test eax, eax," "DBUtilDrv2.Sys" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rbx, rdx,mov rdi, rcx,call 0x1400081b0,mov rdx, rbx,mov rcx, rdi,mov rbx, qword ptr [rsp + 0x30],add rsp, 0x20,pop rdi,jmp 0x140001070,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov rax, qword ptr [rip + 0x2ea7],mov rdi, rcx,lea rcx, [rip + 0x2e85],lea rbx, [rip + 0x2e8e],cmp rax, rcx,je 0x14000123c,cmp rbx, rax,ja 0x14000123c,mov rax, qword ptr [rbx + 0x40],test rax, rax,"42:T45e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")43:T84f,"WdfCoinstaller01009.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\DBUtil_Driver\WdfCoinstaller01009.dll]- [targetUID: 00000000-00000884] "Clarity.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Clarity.dll]- [targetUID: 00000000-00004596] "DellFlashUi.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe]- [targetUID: 00000000-00004596] "Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll]- [targetUID: 00000000-00004596] "Core.dll.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll.config]- [targetUID: 00000000-00004596] "DBUtilDrv2.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%TEMP%\DBUtil_Driver\DBUtilDrv2.cat]- [targetUID: 00000000-00000884] "DBUtilDrv2.inf" has type "Generic INItialization configuration [DestinationDirs]"- Location: [%TEMP%\DBUtil_Driver\DBUtilDrv2.inf]- [targetUID: 00000000-00000884] "DellFlashUi.exe.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe.config]- [targetUID: 00000000-00004596] "C9632CF058AE4321B6B0B5EA39B710FE" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%TEMP%\Helper\C9632CF058AE4321B6B0B5EA39B710FE]- [targetUID: 00000000-00006580] "DBUtilDrv2.Sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\DBUtil_Driver\DBUtilDrv2.Sys]- [targetUID: 00000000-00000884] "FlashComServer.tlb" has type "Type Library (MSFT format)"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\FlashComServer.tlb]- [targetUID: 00000000-00004596]44:T558,"Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")45:Tc21,"Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "LATITUDE_3490_3590_1.26.0.EXE"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "Latitude_3490_3590_1.26.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "")46:T46b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Calls an API typically used to find device information Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Able to perform sandbox evasion using APIs47:T486,"Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Latitude_3490_3590_1.26.0.exe" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\SysWOW64\shlwapi.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "Latitude_3490_3590_1.26.0.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"48:T5e1,"Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\cfgmgr32.DLL" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\FLTLIB.DLL" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\MSVCP140.dll" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\VCRUNTIME140.dll" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\VCRUNTIME140_1.dll" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\WdfCoInstaller01009.dll" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\bcrypt.dll"49:T58d,"Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\temp\66082c6e-81f5-4df1-8286-f56200b49d4e" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "Latitude_3490_3590_1.26.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\DBUtilDrv2.cat" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\dbutildrv2.inf" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\DBUtilDrv2.sys" "C9632CF058AE4321B6B0B5EA39B710FE" trying to access non-existent file "C:\Windows\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.PNF"4a:Tf16,Heuristic match: "]v.no" Heuristic match: "9v.et" Pattern match: "ftp.dell.com/catalog/catalogpc.cab;downloads.dell.com/catalog/catalogpc.cab" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0x`'0v%e%tjh,zcghx" Pattern match: "www.entrust.net/legal-terms19070(c)" Heuristic match: "dbutildrv2.cat" Heuristic match: "c:\users\hapubws\appdata\local\temp\dbutil_driver\dbutildrv2.cat" Heuristic match: "??\c:\users\hapubws\appdata\local\temp\dbutil_driver\dbutildrv2.cat" Heuristic match: "butildrv2.cat" Heuristic match: "??\c:\users\pgfu2ds\appdata\local\temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\dbutildrv2.cat" Heuristic match: "??\c:\users\hapubws\appdata\local\temp\dbutil~1\dbutildrv2.cat" Heuristic match: ":\users\hapubws\appdata\local\temp\dbutil_driver\dbutildrv2.cat" Heuristic match: ":\users\hapubws\appdata\local\temp\dbutil~1\dbutildrv2.cat" Heuristic match: "file: dbutildrv2.cat" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1" Pattern match: "http://www.microsoft.com0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.entrust.net/rpa03" Pattern match: "http://ocsp.entrust.net02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://aia.entrust.net/ts1-chain256.cer01" Pattern match: "http://crl.entrust.net/ts1ca.crl0" Pattern match: "https://www.entrust.net/rpa0" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://ocsp.entrust.net00" Pattern match: "http://crl.entrust.net/g2ca.crl0" Pattern match: "http://ocsp.entrust.net01" Pattern match: "http://crl.entrust.net/csbr1.crl0" Pattern match: "http://www.entrust.net/rpa0" Pattern match: "http://aia.entrust.net/ts2-chain256.p7c01" Pattern match: "http://crl.entrust.net/ts2ca.crl0" Pattern match: "http://aia.entrust.net/ovcs2-chain.p7c01" Pattern match: "http://crl.entrust.net/ovcs2.crl0" Heuristic match: "-y.al" Heuristic match: "~9.si" Heuristic match: "8w.kg" Heuristic match: "ezuy.li" Heuristic match: "\a.bm" Heuristic match: "%,o.sk" Heuristic match: "=zy?.kw" Heuristic match: ",%.gf" Heuristic match: ")gtl.mm" Heuristic match: "]l.fj" Heuristic match: "_f8.at" Heuristic match: "|t^;|e.gu"4b:T2242,Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm2.5.29.10western" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0x" - Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0zxgqwashington1redmond1microsoft" - Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0zxgqnq3)^w1&-g<'http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0zxgqwashington1redmond1microsoft" - Source: "00000000-00000884.00000000.218346.CEED0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000884.00000000.218346.CEED0000.00000004.mdmp") Found URL "http://www.entrust.net/rpa03'0%0" - Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp") Found URL "http://ocsp.entrust.net02+0)0'!http://crl.entrust.net/2048ca.crl0gfv" - Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp") Found URL "http://ocsp.entrust.net03'http://aia.entrust.net/ts1-chain256.cer01*0(0&" - Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp") Found URL "http://crl.entrust.net/ts1ca.crl0;09070)0'https://www.entrust.net/rpa0$0>oan?7entrust," - Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004596.00000001.219522.005E4000.00000004.mdmp") Found URL "http://ocsp.entrust.net01*0(0&" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://crl.entrust.net/csbr1.crl0>0<000(0&http://www.entrust.net/rpa0v=fh=5_8" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://ocsp.entrust.net03'http://aia.entrust.net/ts2-chain256.p7c01*0(0&" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://crl.entrust.net/ts2ca.crl0e0c070)0'https://www.entrust.net/rpa0ll&:v;ts" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://www.entrust.net/rpa03'0%0" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://ocsp.entrust.net00)0'0%http://crl.entrust.net/g2ca.crl0jr&zp$s,usoln%" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://ocsp.entrust.net02&http://aia.entrust.net/ovcs2-chain.p7c01*0(0&" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://crl.entrust.net/ovcs2.crl0e0c070)0'https://www.entrust.net/rpa0ukd;=gk" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://crl.entrust.net/csbr1.crl0>0<000(0&http://www.entrust.net/rpa0>s5(^h" - Source: "00000000-00004596.00000001.219522.00624000.00000004.mdmp") Found URL "http://www.exljbris.comhttp://www.exljbris.commuseo" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://www.entrust.net/rpa03'0%0" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://ocsp.entrust.net00)0'0%http://crl.entrust.net/g2ca.crl0jr&zp$s,usoln%" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://ocsp.entrust.net01*0(0&" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://crl.entrust.net/csbr1.crl0=0;000(0&http://www.entrust.net/rpa0k" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://ocsp.entrust.net02&http://aia.entrust.net/evcs2-chain.p7c01*0(0&" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://crl.entrust.net/evcs2.crl0d0b070)0'https://www.entrust.net/rpa0-" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004596.00000001.219522.041F7000.00000004.mdmp") Found URL "http://www.exljbris.comhttp://www.exljbris.commuseo" - Source: "00000000-00004596.00000001.219522.0423A000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004596.00000001.219522.0423A000.00000004.mdmp") Found URL "http://www.exljbris.comhttp://www.exljbris.commuseo" - Source: "00000000-00004596.00000001.219522.04299000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004596.00000001.219522.0435F000.00000004.mdmp") Found URL "http://ocsp.entrust.net00)0'0%http://crl.entrust.net/g2ca.crl0;402000(0&http://www.entrust.net/rpa0o2,)" - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "http://ocsp.entrust.net05)http://aia.entrust.net/evcs1-chain256.cer01*0(0&" - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "http://crl.entrust.net/evcs1.crl0d0b070)0'https://www.entrust.net/rpa0le>qentrust," - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b060)0'http://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0_yi3(b" - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00004596.00000001.219522.043A1000.00000004.mdmp")4c:T867,Found registry query API: "RegEnumKeyExA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegEnumValueA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegOpenKeyExA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegQueryInfoKeyA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegQueryValueExA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegOpenCurrentUser" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegOpenKeyA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegGetValueA" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegOpenKeyExW" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegQueryValueExW" in file "Latitude_3490_3590_1.26.0.exe" Found registry query API: "RegEnumKeyExA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp" Found registry query API: "RegGetValueA" in "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp"4d:T488,"Latitude_3490_3590_1.26.0.exe" called "FindFirstFileA" with parameter %TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\*.* (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter UI (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindFirstFileA" with parameter %TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\*.* (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter Clarity.dll (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter Core.dll (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter Core.dll.config (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter DellFlashUi.exe (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter DellFlashUi.exe.config (UID: 00000000-00004596) "Latitude_3490_3590_1.26.0.exe" called "FindNextFileA" with parameter FlashComServer.tlb (UID: 00000000-00004596)4e:T53b,file/memory contains long string with (Indicator: "base64"; File: "Core.dll") file/memory contains long string with (Indicator: "createdecryptor"; File: "Core.dll") file/memory contains long string with (Indicator: "createencryptor"; File: "Core.dll") file/memory contains long string with (Indicator: "cryptostream"; File: "Core.dll") file/memory contains long string with (Indicator: "cryptostreammode"; File: "Core.dll") file/memory contains long string with (Indicator: "FromBase64String"; File: "Core.dll") file/memory contains long string with (Indicator: "ToBase64String"; File: "Core.dll") file/memory contains long string with (Indicator: "rijndael"; File: "Core.dll") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "Core.dll") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "Core.dll") file/memory contains long string with (Indicator: "zipfile"; File: "Core.dll") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp")4f:T59f,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")50:Ta65,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.0431D000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")51:T421,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")52:T925,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")53:Ta6c,Found string "What is the maximum password length (see cbSelect = 3 ) ?" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "Password not changed - new password does not meet the criteria!" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "System user password not set!" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "Is a password already set (y/n)?" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "Do you want to set new password (y/n)?" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "New password is Malformed!" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "Unable to set password; Maximum Security Mode (Secure Erase) unavailable!" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "Please enter the admin password to proceed with the flash:" (Indicator: "password"; File: "Latitude_3490_3590_1.26.0.exe") Found string "What is the maximum password length (see cbSelect = 3 ) ?" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "Password not changed - new password does not meet the criteria!" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "System user password not set!" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "Is a password already set (y/n)?" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "Do you want to set new password (y/n)?" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "New password is Malformed!" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "Unable to set password; Maximum Security Mode (Secure Erase) unavailable!" (Indicator: "password"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found string "Please enter the admin password to proceed with the flash:" (Indicator: "password"; Source: "00000000-00004596.00000001.219522.0062F000.00000002.mdmp")54:T688,"C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "NOUSECLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{05F5CFE2-4733-4950-A6BB-07AAD01A3A84}"; Key: "CLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{091BC97E-2352-4362-A539-10A6D8FF7596}"; Key: "CLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{1264760F-A5C8-4BFE-B314-D56A7B44A362}"; Key: "CLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{13E42DFA-85D9-424D-8646-28A70F864F9C}"; Key: "CLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{14B62F50-3F15-11DD-AE16-0800200C9A66}"; Key: "CLASS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "INSTALLER32") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "LOWERFILTERS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "UPPERFILTERS") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "LASTDELETEDATE")55:T1235,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\Helper\C9632CF058AE4321B6B0B5EA39B710FE" (Indicator: "\Device\"; Source: "00000000-00004596-00000BC0-2392784693") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp, 00000000-00000884.00000000.218346.CEED0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp, 00000000-00000884.00000000.218346.CEED0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp") Found string "WS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp") Found string ":\WINDOWS\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Users\HAPUBWS\AppData\Local\Temp\Helper\C9632CF058AE4321B6B0B5EA39B710FE" (Indicator: "\Device\"; Source: "00000000-00000884.00000000.218346.CEC10000.00000004.mdmp") Found string "C:\WINDOWS\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp, 00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS\DBUtilDrv2.sys" (Indicator: "\drivers\"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS\DBUtilDrv2.sys" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS\DBUtilDrv2.sys" (Indicator: "\drivers\"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS\DBUtilDrv2.sys" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string ":\WINDOWS\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.inf" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "\Device\HarddiskVolume3" (Indicator: "\Device\"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.PNF" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.inf" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "??\c:\windows\system32\driverstore\filerepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.inf" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "C:\WINDOWS\System32\DriverStore\FileRepository\dbutildrv2.inf_amd64_7abc468ebf353252\dbutildrv2.inf" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp") Found string "C:\WINDOWS\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found string ":\WINDOWS\System32\drivers\DBUtilDrv2.sys" (Indicator: "\drivers\"; Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found string ":\WINDOWS\System32\drivers\DBUtilDrv2.sys" (Indicator: "system32\drivers"; Source: "00000000-00000884.00000000.218346.CECCD000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004596.00000000.217949.014B0000.00000004.mdmp, 00000000-00004596.00000000.217949.017B0000.00000004.mdmp, 00000000-00004596.00000001.219522.014B0000.00000004.mdmp, 00000000-00004596.00000001.219522.017B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004596.00000000.217949.014B0000.00000004.mdmp, 00000000-00004596.00000000.217949.017B0000.00000004.mdmp, 00000000-00004596.00000001.219522.014B0000.00000004.mdmp, 00000000-00004596.00000001.219522.017B0000.00000004.mdmp")56:T52c,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")57:T520,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp")58:T43b,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "Latitude_3490_3590_1.26.0.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp")59:T541,"Latitude_3490_3590_1.26.0.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\DELL\FIRMWAREUPDATE"; Key: "STAGEUPDATESTATUS"; Value: "0000000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\DELLUTILS\0000"; Key: "PHANTOM"; Value: "0100000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\DELLUTILS\0000"; Key: "CLASSGUID"; Value: "{e0def58b-33e8-4ff0-a75d-f20e1f68e5d7}") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\DELLUTILS\0000"; Key: "HARDWAREID"; Value: "ROOT\DBUtilDrv2") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\DELLUTILS\0000"; Key: "CAPABILITIES"; Value: "0000000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DBUTILDRV2\ENUM"; Key: "COUNT"; Value: "0000000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DBUTILDRV2\ENUM"; Key: "NEXTINSTANCE"; Value: "0000000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{E0DEF58B-33E8-4FF0-A75D-F20E1F68E5D7}"; Key: "LASTDELETEDATE"; Value: "19E8D827B052DD0100")5a:T4b2,"WdfCoinstaller01009.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\DBUtil_Driver\WdfCoinstaller01009.dll]- [targetUID: 00000000-00000884] "Clarity.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Clarity.dll]- [targetUID: 00000000-00004596] "DellFlashUi.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe]- [targetUID: 00000000-00004596] "Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll]- [targetUID: 00000000-00004596] "C9632CF058AE4321B6B0B5EA39B710FE" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%TEMP%\Helper\C9632CF058AE4321B6B0B5EA39B710FE]- [targetUID: 00000000-00006580] "DBUtilDrv2.Sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\DBUtil_Driver\DBUtilDrv2.Sys]- [targetUID: 00000000-00000884]5b:Tb1c,Found string "SleepConditionVariableCS" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "InitOnceExecuteOnce" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateEventExW" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreW" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreExW" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolTimer" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWait" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentPackageId" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetTickCount64" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetFileInformationByHandleEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileInformationByHandle" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "SleepConditionVariableSRW" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWork" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetLocaleInfoEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "AreFileApisANSI" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: Latitude_3490_3590_1.26.0.exe, API is part of module: KERNELBASE.DLL)5c:T5b2,"C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2AFF1901&0&000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2AFF1901&0&000000"; Key: "HARDWAREID") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&2AFF1901&0&000000"; Key: "COMPATIBLEIDS") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "HARDWAREID") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "COMPATIBLEIDS") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "HARDWAREID") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "COMPATIBLEIDS") "C9632CF058AE4321B6B0B5EA39B710FE" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX")5d:T58b,"WdfCoinstaller01009.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\DBUtil_Driver\WdfCoinstaller01009.dll]- [targetUID: 00000000-00000884] "Clarity.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Clarity.dll]- [targetUID: 00000000-00004596] "DellFlashUi.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe]- [targetUID: 00000000-00004596] "Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll]- [targetUID: 00000000-00004596] "Core.dll.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll.config]- [targetUID: 00000000-00004596] "C9632CF058AE4321B6B0B5EA39B710FE" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%TEMP%\Helper\C9632CF058AE4321B6B0B5EA39B710FE]- [targetUID: 00000000-00006580] "DBUtilDrv2.Sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\DBUtil_Driver\DBUtilDrv2.Sys]- [targetUID: 00000000-00000884]5e:Ta42,"Latitude_3490_3590_1.26.0.exe" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\DBUtilDrv2.Sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Latitude_3490_3590_1.26.0.exe" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\WdfCoinstaller01009.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Latitude_3490_3590_1.26.0.exe" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\C9632CF058AE4321B6B0B5EA39B710FE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Latitude_3490_3590_1.26.0.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Clarity.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Latitude_3490_3590_1.26.0.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Latitude_3490_3590_1.26.0.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5f:T8f5,"Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\Helper\C9632CF058AE4321B6B0B5EA39B710FE" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\DBUtilDrv2.Sys" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\DBUtilDrv2.inf" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\DBUtilDrv2.cat" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver\WdfCoinstaller01009.dll" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\DBUtil_Driver" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Clarity.dll" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\Core.dll.config" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\DellFlashUi.exe.config" with delete access "Latitude_3490_3590_1.26.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\66082c6e-81f5-4df1-8286-f56200b49d4e\UI\FlashComServer.tlb" with delete access "C9632CF058AE4321B6B0B5EA39B710FE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\SETFF66.tmp" with delete access "C9632CF058AE4321B6B0B5EA39B710FE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\SETFFE4.tmp" with delete access "C9632CF058AE4321B6B0B5EA39B710FE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\SETFFF5.tmp" with delete access "C9632CF058AE4321B6B0B5EA39B710FE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\SET6.tmp" with delete access1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample dcefe532b75e… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample dcefe532b75e…. Threat score 0/100. 0/25 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"Latitude_3490_3590_1.26.0.exe\",\"applicationCategory\":[\"peexe\",\"executable\"],\"identifier\":\"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":3,\"suspicious\":13},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790974533600,"unified_at":"2026-10-02T20:55:33.600Z","metadata":{"hashes":{"sha256":"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","sha1":"30a8bae323c8a06af5d7cdf34b81046e59ce9841","md5":"8158f7c7c156470f547296541c5a0dcd","sha512":"30ab285731ada69c8131efe1d195daa4e91cacdd03804a66f22cb134bc83b4199570dc1f641e000c4b83778414a7a95572fd38c83e5a9cbb487e04d3cb8466b9","ssdeep":"196608:1TxRyW8lfWI0uivtk1lkg26Nytt7sRaJ/vo8ZdlCEvZPtnUKTOMMC8q+FZ2:ZKWGfWTuCtk1agPN07sRaRo8ElKTz+FM","ssdeep_chunks":["196608:1TxRyW8","196608:TxRyW8l","196608:xRyW8lf","196608:RyW8lfW","196608:yW8lfWI","196608:W8lfWI0","196608:8lfWI0u","196608:lfWI0ui","196608:fWI0uiv","196608:WI0uivt","196608:I0uivtk","196608:0uivtk1","196608:uivtk1l","196608:ivtk1lk","196608:vtk1lkg","196608:tk1lkg2","196608:k1lkg26","196608:1lkg26N","196608:lkg26Ny","196608:kg26Nyt","196608:g26Nytt","196608:26Nytt7","196608:6Nytt7s","196608:Nytt7sR","196608:ytt7sRa","196608:tt7sRaJ","196608:t7sRaJ/","196608:7sRaJ/v","196608:sRaJ/vo","196608:RaJ/vo8","196608:aJ/vo8Z","196608:J/vo8Zd","196608:/vo8Zdl","196608:vo8ZdlC","196608:o8ZdlCE","196608:8ZdlCEv","196608:ZdlCEvZ","196608:dlCEvZP","196608:lCEvZPt","196608:CEvZPtn","196608:EvZPtnU","196608:vZPtnUK","196608:ZPtnUKT","196608:PtnUKTO","196608:tnUKTOM","196608:nUKTOMM","196608:UKTOMMC","196608:KTOMMC8","196608:TOMMC8q","196608:OMMC8q+","196608:MMC8q+F","196608:MC8q+FZ","196608:C8q+FZ2","393216:1TxRyW8","393216:TxRyW8l","393216:xRyW8lf","393216:RyW8lfW","393216:yW8lfWI","393216:W8lfWI0","393216:8lfWI0u","393216:lfWI0ui","393216:fWI0uiv","393216:WI0uivt","393216:I0uivtk","393216:0uivtk1","393216:uivtk1l","393216:ivtk1lk","393216:vtk1lkg","393216:tk1lkg2","393216:k1lkg26","393216:1lkg26N","393216:lkg26Ny","393216:kg26Nyt","393216:g26Nytt","393216:26Nytt7","393216:6Nytt7s","393216:Nytt7sR","393216:ytt7sRa","393216:tt7sRaJ","393216:t7sRaJ/","393216:7sRaJ/v","393216:sRaJ/vo","393216:RaJ/vo8","393216:aJ/vo8Z","393216:J/vo8Zd","393216:/vo8Zdl","393216:vo8ZdlC","393216:o8ZdlCE","393216:8ZdlCEv","393216:ZdlCEvZ","393216:dlCEvZP","393216:lCEvZPt","393216:CEvZPtn","393216:EvZPtnU","393216:vZPtnUK","393216:ZPtnUKT","393216:PtnUKTO","393216:tnUKTOM","393216:nUKTOMM","393216:UKTOMMC","393216:KTOMMC8","393216:TOMMC8q","393216:OMMC8q+","393216:MMC8q+F","393216:MC8q+FZ","393216:C8q+FZ2","196608:ZKWGfWT","196608:KWGfWTu","196608:WGfWTuC","196608:GfWTuCt","196608:fWTuCtk","196608:WTuCtk1","196608:TuCtk1a","196608:uCtk1ag","196608:Ctk1agP","196608:tk1agPN","196608:k1agPN0","196608:1agPN07","196608:agPN07s","196608:gPN07sR","196608:PN07sRa","196608:N07sRaR","196608:07sRaRo","196608:7sRaRo8","196608:sRaRo8E","196608:RaRo8El","196608:aRo8ElK","196608:Ro8ElKT","196608:o8ElKTz","196608:8ElKTz+","196608:ElKTz+F","196608:lKTz+FM"],"imphash":"29a2a0dfa40d3062d8fe710a88781d9e","pehash":"195517f6df9b49ddcc15bc9df134ca40ca66faf7"},"file_info":{"file_name":"Latitude_3490_3590_1.26.0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":11833808,"entropy":8,"compile_timestamp":"2023-05-08T12:31:18","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790974381000,"last_seen":1790974381000,"last_multi_scan":1790974381000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":872092,"raw_size":872448},{"name":".rdata","virtual_address":"0xd6000","virtual_size":186366,"raw_size":186368},{"name":".data","virtual_address":"0x104000","virtual_size":3712120,"raw_size":3410944},{"name":".rsrc","virtual_address":"0x48f000","virtual_size":1712,"raw_size":2048},{"name":".reloc","virtual_address":"0x490000","virtual_size":41720,"raw_size":41984}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":195,"suspicious_count":13,"malicious_count":3,"total":211},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Firmware","attack_id":"T1592.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1592/003","identifiers":[{"type":"informative","value":"Able to gather system firmware table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":".NET code is able to query registry"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"malicious","value":"Drops system driver"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"Core.dll\")\n Found string \"unknown compression method\" (Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"Clarity.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStructure\" in \"Clarity.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"StructureToPtr\" in \"Clarity.dll\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"Clarity.dll\"\n Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"DellFlashUi.exe\"\n Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"Core.dll\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Core.dll\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\Helper\\ (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\DBUtil_Driver\\ (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e (UID: 00000000-00004596)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"CryptoStream\"; File: \"Core.dll\")\n file/memory contains long string with (Indicator: \"DeriveBytes\"; File: \"Core.dll\")\n file/memory contains long string with (Indicator: \"PasswordDeriveBytes\"; File: \"Core.dll\")\n file/memory contains long string with (Indicator: \"Rijndael\"; File: \"Core.dll\")\n file/memory contains long string with (Indicator: \"RijndaelManaged\"; File: \"Core.dll\")\n file/memory contains long string with (Indicator: \"SymmetricAlgorithm\"; File: \"Core.dll\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp\")\n Found reference to \"ECDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System.Reflection\" and MemberReference \"GetMethodFromHandle\" in \"Clarity.dll\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethodFromHandle\" in \"DellFlashUi.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"$28","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004596.00000001.219522.014B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004596.00000001.219522.041F7000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004596.00000001.219522.042DB000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004596.00000001.219522.0431D000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004596.00000001.219522.045B1000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DBUtil_2_5; Source: \"Latitude_3490_3590_1.26.0.exe\")\n Found string - \\\\.\\DBUtil_2_5; Source: \"00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Latitude_3490_3590_1.26.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Latitude_3490_3590_1.26.0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2391981115 [PID: 4596]\n \"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2391987223 [PID: 4596]\n \"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2392240823 [PID: 4596]\n \"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2392247184 [PID: 4596]\n \"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2392389437 [PID: 4596]\n \"Latitude_3490_3590_1.26.0.exe\" queried SystemProcessInformation at 00000000-00004596-00000C15-2392395572 [PID: 4596]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFF66.tmp\" to \"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\WdfCoInstaller01009.dll\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFFE4.tmp\" to \"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\DBUtilDrv2.cat\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFFF5.tmp\" to \"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\dbutildrv2.inf\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SET6.tmp\" to \"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\DBUtilDrv2.sys\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"Core.dll\"\n Observed function \"ToBase64String\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"Core.dll\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertGetCertificateContextProperty\" (Indicator: \"CertGetCertificateContextProperty\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000884.00000000.218346.CECCD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Core.dll\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"Core.dll\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000884.00000000.218346.CECCD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000884.00000000.218346.CEC10000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004596.00000000.217949.014B0000.00000004.mdmp, 00000000-00004596.00000001.219522.014B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000884.00000000.218346.CEC5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(File: \"Latitude_3490_3590_1.26.0.exe\")\n file/memory contains long string(Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.005DF000.00000004.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"Core.dll\")\n Found string \"etUserNameW\" (Source: \"00000000-00000884.00000000.218346.CECCD000.00000004.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found string \"BIOSVersion :\" (Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.005DF000.00000004.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"QueryServiceStatusEx\" (File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004596)\n \"C9632CF058AE4321B6B0B5EA39B710FE\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004596)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"IsWow64Process\" with parameter \"4596\" - (UID: 00000000-00004596)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004596)\n \"C9632CF058AE4321B6B0B5EA39B710FE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006580)\n \"C9632CF058AE4321B6B0B5EA39B710FE\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000884)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_Volume WHERE BootVolume = True\" (Indicator: \"select * from \"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"SELECT * FROM Win32_Volume WHERE BootVolume = True\" (Indicator: \"select * from \"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set dock to user mode successful at Location: %d\" (Indicator: \"set \"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"Set MLK dock flag to TRUE.\" (Indicator: \"set \"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"Set Salomon Upgraded dock flag to TRUE.\" (Indicator: \"set \"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"Set dock package version res = 0x%x\" (Indicator: \"set \"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"Set charger package version res = 0x%x\" (Indicator: \"set \"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: Latitude_3490_3590_1.26.0.exe\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp\n 00000000-00004596.00000001.219522.034E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueKind\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Latitude_3490_3590_1.26.0.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Latitude_3490_3590_1.26.0.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Core.dll\")\n file/memory contains long string(File: \"C9632CF058AE4321B6B0B5EA39B710FE\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")\n Found string \"GetCommandLineOptionsWWW\" (Source: \"00000000-00004596.00000001.219522.005E4000.00000004.mdmp, 00000000-00004596.00000001.219522.0423A000.00000004.mdmp, 00000000-00004596.00000001.219522.045B1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\DBUtil_Driver\\ (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\Helper\\ (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI (UID: 00000000-00004596)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE F\" - (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE %TEMP%\\DBUtil_Driver\\DBUtilDrv2.inf\" - (UID: 00000000-00004596)\n \"Latitude_3490_3590_1.26.0.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE U\" - (UID: 00000000-00004596)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_Volume WHERE BootVolume = True\" (Source: Latitude_3490_3590_1.26.0.exe, Indicator: \"select * from win32_volume where bootvolume = true\")\n \"SELECT * FROM Win32_Volume WHERE BootVolume = True\" (Source: 00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, Indicator: \"select * from win32_volume where bootvolume = true\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ERROR: CreateProcess FAILED (%d)\" (Indicator: \"CreateProcess\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ERROR: CreateProcess FAILED (%d)\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Latitude_3490_3590_1.26.0.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: C9632CF058AE4321B6B0B5EA39B710FE)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Core.dll\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"WdfCoinstaller01009.dll\" contains export function called \"WdfCoInstaller\" at ordinal 1\n \"WdfCoinstaller01009.dll\" contains export function called \"WdfPostDeviceInstall\" at ordinal 2\n \"WdfCoinstaller01009.dll\" contains export function called \"WdfPostDeviceRemove\" at ordinal 3\n \"WdfCoinstaller01009.dll\" contains export function called \"WdfPreDeviceInstall\" at ordinal 4\n \"WdfCoinstaller01009.dll\" contains export function called \"WdfPreDeviceInstallEx\" at ordinal 5\n \"WdfCoinstaller01009.dll\" contains export function called \"WdfPreDeviceRemove\" at ordinal 6","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Core.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3c","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3d","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetMonitorInfo\" in \"Clarity.dll\"\n Observed unmanaged function \"MonitorFromWindow\" in \"Clarity.dll\"\n Observed unmanaged function \"SendMessage\" in \"Clarity.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Latitude_3490_3590_1.26.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 757A0000\n \"C9632CF058AE4321B6B0B5EA39B710FE\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 130B0000\n \"C9632CF058AE4321B6B0B5EA39B710FE\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 12150000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Latitude_3490_3590_1.26.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76300000\n \"C9632CF058AE4321B6B0B5EA39B710FE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 134D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$40","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Clarity.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"DellFlashUi.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Core.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Latitude_3490_3590_1.26.0.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"WdfCoinstaller01009.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Clarity.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DellFlashUi.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Core.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DBUtilDrv2.Sys\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Latitude_3490_3590_1.26.0.exe\" has an executable section named \".text\"\n \"WdfCoinstaller01009.dll\" has an executable section named \".text\"\n \"Clarity.dll\" has an executable section named \".text\"\n \"DellFlashUi.exe\" has an executable section named \".text\"\n \"Core.dll\" has an executable section named \".text\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" has an executable section named \".text\"\n \"DBUtilDrv2.Sys\" has an executable section named \".text\"\n \"DBUtilDrv2.Sys\" has an executable section named \"PAGE\"\n \"DBUtilDrv2.Sys\" has an executable section named \"INIT\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Latitude_3490_3590_1.26.0.exe\" has an writable section named \".data\"\n \"WdfCoinstaller01009.dll\" has an writable section named \".data\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" has an writable section named \".data\"\n \"DBUtilDrv2.Sys\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$41","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x340c00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x192200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x38a478\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x19216c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" has high imagebase \"0x140000000\"\n \"DBUtilDrv2.Sys\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"C9632CF058AE4321B6B0B5EA39B710FE\" (UID: 00000000-00006580) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"C9632CF058AE4321B6B0B5EA39B710FE\" (UID: 00000000-00006580) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"F\" (UID: 00000000-00006580)\n Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"%TEMP%\\\\DBUtil_Driver\\\\DBUtilDrv2.inf\" (UID: 00000000-00000884)\n Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"U\" (UID: 00000000-00004968)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"F\" (UID: 00000000-00006580)\n Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"%TEMP%\\\\DBUtil_Driver\\\\DBUtilDrv2.inf\" (UID: 00000000-00000884)\n Spawned process \"C9632CF058AE4321B6B0B5EA39B710FE\" with commandline \"U\" (UID: 00000000-00004968)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Entrust Root Certification Authority - G2, OU=\"c 2009 Entrust\n Inc. - for authorized use only\", OU=See www.entrust.net/legal-terms, O=\"Entrust\n Inc.\", C=US\" (SHA1: B3:37:B8:FD:B5:6E:CB:58:BF:5D:BC:F8:C2:2C:32:01:07:53:5A:02; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Entrust Code Signing CA - OVCS2, O=\"Entrust\n Inc.\", C=US\" (SHA1: BF:71:32:A2:34:43:1E:95:38:14:A6:10:D5:A1:18:50:29:F3:A7:11; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Entrust Code Signing Root Certification Authority - CSBR1, O=\"Entrust\n Inc.\", C=US\" (SHA1: A6:1D:C5:D9:0A:06:00:3E:B4:DD:35:99:B7:A0:52:FC:3F:70:D7:CC; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Latitude_3490_3590_1.26.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Clarity.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DellFlashUi.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Core.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DBUtil_Driver\\DBUtilDrv2.Sys\"\n \"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DBUtil_Driver\\DBUtilDrv2.inf\"\n \"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DBUtil_Driver\\DBUtilDrv2.cat\"\n \"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DBUtil_Driver\\WdfCoinstaller01009.dll\"\n \"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\"\n \"Latitude_3490_3590_1.26.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Clarity.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" create file \"C:\\Windows\\System32\\DriverStore\\FileRepository\\dbutildrv2.inf_amd64_7abc468ebf353252\\dbutildrv2.PNF\"\n \"C9632CF058AE4321B6B0B5EA39B710FE\" create file \"%WINDIR%\\System32\\DriverStore\\FileRepository\\dbutildrv2.inf_amd64_7abc468ebf353252\\dbutildrv2.PNF\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"Core.dll.config\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Core.dll.config]\n \"DellFlashUi.exe.config\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\DellFlashUi.exe.config]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"DBUtilDrv2.inf\" has type \"Generic INItialization configuration [DestinationDirs]\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"WdfCoinstaller01009.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections\"- Location: [%TEMP%\\DBUtil_Driver\\WdfCoinstaller01009.dll]- [targetUID: 00000000-00000884]\n \"Clarity.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Clarity.dll]- [targetUID: 00000000-00004596]\n \"Core.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Core.dll]- [targetUID: 00000000-00004596]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Latitude_3490_3590_1.26.0.exe\" queries basic process information of the \"C:\\Latitude_3490_3590_1.26.0.exe\" (UID: 4596)\n \"Latitude_3490_3590_1.26.0.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (UID: 4596)\n \"C9632CF058AE4321B6B0B5EA39B710FE\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (UID: 6580)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Latitude_3490_3590_1.26.0.exe\" reads file \"c:\\latitude_3490_3590_1.26.0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$46","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" touched file \"C:\\Windows\\INF\\setupapi.dev.log\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\dbutil_driver\\dbutildrv2.sys\"\n \"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\dbutil_driver\\dbutildrv2.inf\"\n \"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\dbutil_driver\\dbutildrv2.cat\"\n \"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\dbutil_driver\\wdfcoinstaller01009.dll\"\n \"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\helper\\c9632cf058ae4321b6b0b5ea39b710fe\"\n \"Latitude_3490_3590_1.26.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\66082c6e-81f5-4df1-8286-f56200b49d4e\\ui\\clarity.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"DBUtilDrv2.Sys\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"Core.dll\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.2\"\n Potential IP \"2.7.0.0\" found in string \"em12.inf:c14ce884ace7bd5f:DBUtilDrv2_Device:2.7.0.0:root\\dbutildrv2\"\n Potential IP \"2.7.0.0\" found in string \"em12.inf:c14ce884ace7bd5f:DBUtilDrv2_Device:2.7.0.0:root\\dbutildrv2,\"\n Potential IP \"2.7.0.0\" found in string \"em12.inf:c14ce884ace7bd5f:dbutildrv2_device:2.7.0.0:root\\dbutildrv2\"\n Potential IP \"2.7.0.0\" found in string \"er = 05/06/2021,2.7.0.0\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n \"2.5.4.3\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.10\"\n \"2.5.29.17\"\n Potential IP \"2.7.0.0\" found in string \"oem12.inf:c14ce884ace7bd5f:DBUtilDrv2_Device:2.7.0.0:root\\dbutildrv2,\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"2.5.4.7\"\n \"2.5.4.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"Clarity.dll\"\n YARA signature for RSA public and private key matched on file \"DellFlashUi.exe\"\n YARA signature for RSA public and private key matched on file \"Core.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"d13725a-8de0-47fd-b6f5-088264d2d6bb@ncalrpc:[,Security=Impersonation Dynamic True]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000884.00000000.218346.CECCD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Latitude_3490_3590_1.26.0.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: C9632CF058AE4321B6B0B5EA39B710FE]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Latitude_3490_3590_1.26.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"C9632CF058AE4321B6B0B5EA39B710FE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"$54","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"Latitude_3490_3590_1.26.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: WdfCoinstaller01009.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: WdfCoinstaller01009.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$55","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp, 00000000-00004596.00000001.219522.043A1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DBUTILDRV2\\ENUM\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DBUTILDRV2\\ENUM\"; Key: \"COUNT\"; Value: \"0000000000\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DBUTILDRV2\\ENUM\"; Key: \"NEXTINSTANCE\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Latitude_3490_3590_1.26.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"Latitude_3490_3590_1.26.0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\HELPER\\C9632CF058AE4321B6B0B5EA39B710FE\"; Value: \"\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DBUTILDRV2\\ENUM\"; Key: \"COUNT\"; Value: \"\")\n \"C9632CF058AE4321B6B0B5EA39B710FE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DBUTILDRV2\\ENUM\"; Key: \"0\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"NtShutdownSystem\" (Indicator: \"ShutdownSystem\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"NtShutdownSystem\" (Indicator: \"ShutdownSystem\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"Latitude_3490_3590_1.26.0.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Latitude_3490_3590_1.26.0.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Clarity.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"\n \"DellFlashUi.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Core.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Latitude_3490_3590_1.26.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".data\" has very low entropy (0.81)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Latitude_3490_3590_1.26.0.exe\" has section name .data with entropy \"7.9965260933069295\"\n \"WdfCoinstaller01009.dll\" has section name .rsrc with entropy \"7.999713094204675\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\DBUtil_Driver\\WdfCoinstaller01009.dll\" has high entropy 7.97815\n Dropped file \"%TEMP%\\DBUtil_Driver\\DBUtilDrv2.cat\" has high entropy 7.09272","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"CI\\VEN_15AD&DEV_07C0&SUBSYS_07C015AD&REV_02\\CA557E405005056200\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"WdfCoinstaller01009.dll\" has resource with unusual entropy \"RT_RCDATA:7.999767228685308\"\n \"DellFlashUi.exe\" has resource with unusual entropy \"RT_ICON:7.827337807933141\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"File \"DBUtilDrv2.cat\" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 33000000b5213fca1e4aa03de40000000000b5; Valid From: 12/15/2020 22:15:33; Until: 12/02/2021 22:15:33; Fingerprints: MD5=67:23:ED:53:D6:54:BE:71:EA:33:48:98:CF:38:1D:49; SHA1=38:B7:C7:4E:37:39:27:13:E4:36:E1:9A:2B:E0:53:10:01:15:DA:88)\n File \"DBUtilDrv2.cat\" is a certificate (Owner: CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Certificate Authority 2010, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 610baac1000000000009; Valid From: 04/18/2012 23:48:38; Until: 04/18/2027 23:58:38; Fingerprints: MD5=FD:52:D6:A0:3B:B4:7F:69:A2:5C:C4:B0:6D:B8:B8:CC; SHA1=77:A1:0E:BF:07:54:27:25:21:8C:D8:3A:01:B5:21:C5:7B:C6:7F:73)","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption\" (Indicator: \"root\\cimv2\"; in File: \"Latitude_3490_3590_1.26.0.exe\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")\n Found string \"ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004596.00000000.217949.00276000.00000002.mdmp, 00000000-00004596.00000001.219522.034E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"WdfCoinstaller01009.dll\" claimed CRC 11839797 while the actual is CRC 1775723\n \"Clarity.dll\" claimed CRC 1775723 while the actual is CRC 874787\n \"DellFlashUi.exe\" claimed CRC 874787 while the actual is CRC 315925\n \"Core.dll\" claimed CRC 315925 while the actual is CRC 72758\n \"C9632CF058AE4321B6B0B5EA39B710FE\" claimed CRC 72758 while the actual is CRC 144872\n \"DBUtilDrv2.Sys\" claimed CRC 144872 while the actual is CRC 70220","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n CreateFileW\n CreateProcessA\n GetFileSizeEx\n VirtualProtect\n FindResourceExW\n CreateThread\n FindNextFileA\n GetProcAddress\n WriteFile\n GetCommandLineA\n DeviceIoControl\n CreateDirectoryA\n GetFileAttributesA\n FindFirstFileA\n LoadLibraryExW\n FindFirstFileExW\n CreateDirectoryW\n LoadLibraryExA\n GetCommandLineW\n GetStartupInfoW\n OutputDebugStringW\n GetTempPathA\n CreateFileA\n GetModuleFileNameW\n GetSystemInfo\n GetModuleHandleW\n GetModuleHandleExW\n Sleep\n GetModuleFileNameA\n LockResource\n UnhandledExceptionFilter\n GetVersionExA\n GetSystemDirectoryA\n GetModuleHandleA\n DeleteFileA\n FindNextFileW\n TerminateProcess\n FindResourceW\n OutputDebugStringA\n GetDriveTypeW\n IsDebuggerPresent\n RegCloseKey\n RegOpenKeyExW\n RegCreateKeyExW\n ChangeServiceConfigW\n CreateProcessW\n GetTickCount\n DeleteFileW\n FindFirstFileW\n LoadLibraryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402827146\n \"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402830788\n \"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402831576\n \"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402835547\n \"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402939524\n \"Latitude_3490_3590_1.26.0.exe\" at 00000000-00004596-00000C15-2402943093","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"DBUtilDrv2.Sys\" has type \"PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Latitude_3490_3590_1.26.0.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (Handle: 512)\n \"Latitude_3490_3590_1.26.0.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (Handle: 512)\n \"Latitude_3490_3590_1.26.0.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (Handle: 828)\n \"Latitude_3490_3590_1.26.0.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE\" (Handle: 828)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}],"intel_graph":{"map":{"File:15d1aff6f19328823c9509efc00976b25c348c0ed168add27ba0e037492f8c09":{"type":"File","value":"15d1aff6f19328823c9509efc00976b25c348c0ed168add27ba0e037492f8c09"},"File:3b9264416a78f5eab2812cd46b14f993815e9dbf5bd145b3876c2f0f93b98521":{"type":"File","value":"3b9264416a78f5eab2812cd46b14f993815e9dbf5bd145b3876c2f0f93b98521"},"File:4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb":{"type":"File","value":"4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:56ed7ff7299c83b307282ce8d1def51d72a3663249e72a32c09f6264348b1da2":{"type":"File","value":"56ed7ff7299c83b307282ce8d1def51d72a3663249e72a32c09f6264348b1da2"},"File:71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009":{"type":"File","value":"71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"},"File:7b9ec0aea0a6bc4ee6e010dc4beb45111b797d32058711ef7a8899fb4d867c4a":{"type":"File","value":"7b9ec0aea0a6bc4ee6e010dc4beb45111b797d32058711ef7a8899fb4d867c4a"},"File:8e3a9d63734c1bd79f15beb1434517b62495d9d56005809d6d0c0a109ecce5d4":{"type":"File","value":"8e3a9d63734c1bd79f15beb1434517b62495d9d56005809d6d0c0a109ecce5d4"},"File:98c53347fb37d5ea3d1cb0597d7ac48260010d2ddc7bcb7fccf9c2fb6d06942b":{"type":"File","value":"98c53347fb37d5ea3d1cb0597d7ac48260010d2ddc7bcb7fccf9c2fb6d06942b"},"File:af5988ecc994f0bb03f152200f30e65bd8ab994e9e7080c21a9710157a9b2d65":{"type":"File","value":"af5988ecc994f0bb03f152200f30e65bd8ab994e9e7080c21a9710157a9b2d65"},"File:c77c24e945acc73d6b723f60bcdc0330ff501eea34b7da95061101dd1120392a":{"type":"File","value":"c77c24e945acc73d6b723f60bcdc0330ff501eea34b7da95061101dd1120392a"},"File:cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc":{"type":"File","value":"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc"},"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf":{"type":"File","value":"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f1d2dce13568fe2a54a10b1bae13050550709b2d12e1af3025dd4ea3344b1a8c":{"type":"File","value":"f1d2dce13568fe2a54a10b1bae13050550709b2d12e1af3025dd4ea3344b1a8c"}},"chains":[{"id":"1555684067972960247","root":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1555684130859655907","root":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","edges":[{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:15d1aff6f19328823c9509efc00976b25c348c0ed168add27ba0e037492f8c09"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:98c53347fb37d5ea3d1cb0597d7ac48260010d2ddc7bcb7fccf9c2fb6d06942b"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:8e3a9d63734c1bd79f15beb1434517b62495d9d56005809d6d0c0a109ecce5d4"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:c77c24e945acc73d6b723f60bcdc0330ff501eea34b7da95061101dd1120392a"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:56ed7ff7299c83b307282ce8d1def51d72a3663249e72a32c09f6264348b1da2"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:3b9264416a78f5eab2812cd46b14f993815e9dbf5bd145b3876c2f0f93b98521"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:af5988ecc994f0bb03f152200f30e65bd8ab994e9e7080c21a9710157a9b2d65"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:f1d2dce13568fe2a54a10b1bae13050550709b2d12e1af3025dd4ea3344b1a8c"},{"edge_kind":"extracted","from_key":"File:dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","to_key":"File:7b9ec0aea0a6bc4ee6e010dc4beb45111b797d32058711ef7a8899fb4d867c4a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ac019abd9eecdde12039da8","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Latitude_3490_3590_1.26.0.exe","analysis_start_time":"2026-10-02T20:53:02+00:00","indicators_count":{"informative":195,"suspicious":35,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}],"processes":[{"pid":4596,"ppid":0,"name":"Latitude_3490_3590_1.26.0.exe","command_line":"","sha256":"dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf","normalized_path":"C:\\Latitude_3490_3590_1.26.0.exe","uid":"00000000-00004596","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":6580,"ppid":4596,"name":"C9632CF058AE4321B6B0B5EA39B710FE","command_line":"F","sha256":"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc","normalized_path":"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE","parent_uid":"00000000-00004596","uid":"00000000-00006580"},{"pid":884,"ppid":4596,"name":"C9632CF058AE4321B6B0B5EA39B710FE","command_line":"%TEMP%\\DBUtil_Driver\\DBUtilDrv2.inf","sha256":"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc","normalized_path":"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE","parent_uid":"00000000-00004596","uid":"00000000-00000884"},{"pid":4968,"ppid":4596,"name":"C9632CF058AE4321B6B0B5EA39B710FE","command_line":"U","sha256":"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc","normalized_path":"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE","parent_uid":"00000000-00004596","uid":"00000000-00004968"}],"all_imported_dlls":["vcruntime140_1.dll","ole32.dll","CoreMessaging.dll","cryptbase.dll","crypt32.dll","msvcp140.dll","win32u.dll","wow64base.dll","KernelBase.dll","gdi32.dll","vcruntime140.dll","advapi32.dll","kernel.appcore.dll","CoreUIComponents.dll","clbcatq.dll","ws2_32.dll","cryptsp.dll","rsaenh.dll","wow64win.dll","msvcrt.dll","VxSSL32.dll","wintrust.dll","msasn1.dll","wow64con.dll","fltLib.dll","imm32.dll","spinf.dll","rpcrt4.dll","ucrtbase.dll","uxtheme.dll","newdev.dll","SHCore.dll","msctf.dll","WinTypes.dll","kernel32.dll","bcryptprimitives.dll","VxSSL64.dll","devobj.dll","TextShaping.dll","drvstore.dll","WofUtil.dll","shlwapi.dll","sechost.dll","setupapi.dll","cabinet.dll","TextInputFramework.dll","gpapi.dll","bcrypt.dll","drvsetup.dll","ntdll.dll","wow64cpu.dll","cfgmgr32.dll","ntmarta.dll","apphelp.dll","user32.dll","oleaut32.dll","devrtl.dll","wow64.dll","gdi32full.dll","msvcp_win.dll","combase.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb","sha256":"4e636aee31b976fb281eda87f6228314358dc6684bb4d1e3e7220a86b729a6fb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Clarity.dll","sha256":"15d1aff6f19328823c9509efc00976b25c348c0ed168add27ba0e037492f8c09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Core.dll","sha256":"98c53347fb37d5ea3d1cb0597d7ac48260010d2ddc7bcb7fccf9c2fb6d06942b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DellFlashUi.exe","sha256":"8e3a9d63734c1bd79f15beb1434517b62495d9d56005809d6d0c0a109ecce5d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DBUtilDrv2.Sys","sha256":"71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DBUtilDrv2.cat","sha256":"c77c24e945acc73d6b723f60bcdc0330ff501eea34b7da95061101dd1120392a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DBUtilDrv2.inf","sha256":"56ed7ff7299c83b307282ce8d1def51d72a3663249e72a32c09f6264348b1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"WdfCoinstaller01009.dll","sha256":"3b9264416a78f5eab2812cd46b14f993815e9dbf5bd145b3876c2f0f93b98521","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"C9632CF058AE4321B6B0B5EA39B710FE","sha256":"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Core.dll.config","sha256":"af5988ecc994f0bb03f152200f30e65bd8ab994e9e7080c21a9710157a9b2d65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DellFlashUi.exe.config","sha256":"f1d2dce13568fe2a54a10b1bae13050550709b2d12e1af3025dd4ea3344b1a8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"FlashComServer.tlb","sha256":"7b9ec0aea0a6bc4ee6e010dc4beb45111b797d32058711ef7a8899fb4d867c4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\DBUtil_Driver\\DBUtilDrv2.Sys","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\DBUtil_Driver\\DBUtilDrv2.inf","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\DBUtil_Driver\\DBUtilDrv2.cat","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\DBUtil_Driver\\WdfCoinstaller01009.dll","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\Helper\\C9632CF058AE4321B6B0B5EA39B710FE","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Clarity.dll","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Core.dll","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\Core.dll.config","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\DellFlashUi.exe","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\DellFlashUi.exe.config","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\66082c6e-81f5-4df1-8286-f56200b49d4e\\UI\\FlashComServer.tlb","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"GLOBALROOT\\C:\\WINDOWS","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%WINDIR%\\INF\\setupapi.dev.log","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFF66.tmp","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFFE4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SETFFF5.tmp","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%TEMP%\\{9373ddb6-23f1-0d4e-a005-14e28fe8b69b}\\SET6.tmp","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\dbutildrv2.inf_amd64_7abc468ebf353252\\dbutildrv2.PNF","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\DELL\\FIRMWAREUPDATE\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\DELL\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ROOT\\DELLUTILS\\0000\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ROOT\\DELLUTILS\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\DRIVERS\\DRIVERDATABASE\\DEVICEIDS\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\DRIVERS\\DRIVERDATABASE\\DRIVERINFFILES\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"key":"HKLMHKLM\\DRIVERS\\DRIVERDATABASE\\DRIVERPACKAGES\\","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\ENUM\\ROOT\\DELLUTILS\\0000\\PHANTOM\\PHANTOM","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\BaseNamedObjects\\DELL_BIOS_FLASH_LOGGING_MUTEX","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\BaseNamedObjects\\DELL_BIOS_FLASH_MUL_INSTANCE_MUTEX","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBUTILDRVMUX","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4596:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"SM0:4596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Local\\SM0:4596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"SM0:4596:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"DBUTILDRVMUX","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Local\\SM0:6580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"SM0:6580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"SM0:884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Local\\SM0:884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4968:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4968:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"Local\\SM0:4968:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]},{"name":"SM0:4968:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac019abd9eecdde12039da8"}]}]}},"report_ids":{"sandbox_job_ids":["6ac019abd9eecdde12039da8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample dcefe532b75e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample dcefe532b75e…. Threat score 0/100. 0/25 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf"}],["$","meta","4",{"property":"og:title","content":"Sample dcefe532b75e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample dcefe532b75e…. Threat score 0/100. 0/25 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dcefe532b75e49acc670b43d74d275564025ade002ce89793fec3c25dcf410cf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample dcefe532b75e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample dcefe532b75e…. Threat score 0/100. 0/25 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L60","11",{}]]