26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample e685c5e8ec5c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e685c5e8ec5c…. Malware family: Mint.Zard.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 12 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d"],"about":{"@type":"SoftwareApplication","name":"saiec.exe","applicationCategory":["peexe","executable"],"identifier":"e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T646,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")28:Td48,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")29:Ta57,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")2a:T45a,Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")2b:T1320,Assembly shows XOR instruction xor eax dword ptr [00FD26F0h] in Stream UID: 00000000-00007604-17726-1266-00F8BE49 Assembly shows XOR instruction xor eax dword ptr [00FD26F0h] in Stream UID: 00000000-00007604-17726-1271-00F8BE2A Assembly shows XOR instruction xor eax dword ptr [00FD26F0h] in Stream UID: 00000000-00007604-17726-1273-00F8BE8E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-1276-00F90FA4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-1276-00F90FA4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-1280-00F8EE4F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-1280-00F8EE4F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-1286-00F9ABA3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-1286-00F9ABA3 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00007604-17726-1333-00FA0E70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-1333-00FA0E70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-1333-00FA0E70 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00007604-17726-1344-00F8D759 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00007604-17726-1344-00F8D759 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00007604-17726-1344-00F8D759 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00007604-17726-1344-00F8D759 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-1893-00F4C646 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-1893-00F4C646 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2425-00F2166C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2425-00F2166C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2428-00F21810 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2428-00F21810 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2437-00F221AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2437-00F221AA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2455-00F93BAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2455-00F93BAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2504-00F84ED5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2504-00F84ED5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2519-00F8B7A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2519-00F8B7A0 Assembly shows XOR instruction xor eax dword ptr [00FD26F0h] in Stream UID: 00000000-00007604-17726-2521-00F8CA04 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2527-00F9735A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2527-00F9735A Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00007604-17726-2532-00F9BE6C Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00007604-17726-2532-00F9BE6C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2556-00F92E73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2556-00F92E73 Assembly shows XOR instruction xor eax dword ptr [00FD26F0h] in Stream UID: 00000000-00007604-17726-2577-00F8C7BE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2591-00F8C454 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2591-00F8C454 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2627-00F220D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2627-00F220D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2644-00F2308F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2644-00F2308F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2658-00F2379F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2658-00F2379F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007604-17726-2676-00F2395F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007604-17726-2676-00F2395F2c:T12c0,Found XOR loop in file "client.exe" at offset 22403; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 58537; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 103737; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 115971; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 131473; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 132982; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 197050; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 226644; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 228849; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 268160; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 316711; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 329239; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 350915; code bytes = 30d0 Found XOR loop in file "client.exe" at offset 52188; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 56580; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 89601; code bytes = 33c1 Found XOR loop in file "client.exe" at offset 313347; code bytes = 30040e Found XOR loop in file "client.exe" at offset 56256; code bytes = 8030 Found XOR loop in file "client.exe" at offset 70679; code bytes = 8030 Found XOR loop in file "client.exe" at offset 85317; code bytes = 8030 Found XOR loop in file "client.exe" at offset 92714; code bytes = 8030 Found XOR loop in file "client.exe" at offset 95863; code bytes = 8030 Found XOR loop in file "client.exe" at offset 112869; code bytes = 8030 Found XOR loop in file "client.exe" at offset 117936; code bytes = 8030 Found XOR loop in file "client.exe" at offset 121309; code bytes = 8030 Found XOR loop in file "client.exe" at offset 125572; code bytes = 8030 Found XOR loop in file "client.exe" at offset 138810; code bytes = 8030 Found XOR loop in file "client.exe" at offset 169494; code bytes = 8030 Found XOR loop in file "client.exe" at offset 170638; code bytes = 8030 Found XOR loop in file "client.exe" at offset 284676; code bytes = 8030 Found XOR loop in file "client.exe" at offset 287838; code bytes = 8030 Found XOR loop in file "client.exe" at offset 344033; code bytes = 8030 Found XOR loop in file "client.exe" at offset 350898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 22403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 58537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 103737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 115971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 131473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 132982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 197050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 228849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 268160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 316711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 329239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 52188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 56580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 89601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 313347; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 56256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 70679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 85317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 92714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 95863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 112869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 117936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 121309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 125572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 138810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 170638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 284676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 287838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 344033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 350898; code bytes = 80302d:T42a,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")2e:T5ef,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")2f:T412,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")30:Tcee,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")31:Td00,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")32:T844,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")33:T7c7,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp"34:T412,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")35:T114d,"0" (Indicator: "select * from "; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")37:T704,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007604-17726-2849-00F8C9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007604-17726-2854-00F8C8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-2857-00F8C94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007604-17726-2868-00F9A8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007604-17726-2869-00F9A2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007604-17726-2870-00F9A39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007604-17726-2872-00F9A322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-2873-00F9A741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-3537-00F7E55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-3717-00F9A232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-3720-00F9A422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-3721-00F9A7EE GetLocaleInfoW@KERNEL32.DLL at 00000000-00007604-17726-3722-00F9A617 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007384-25864-2830-00F8C9AE EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007384-25864-2835-00F8C8C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-2838-00F8C94A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007384-25864-2849-00F9A8C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007384-25864-2850-00F9A2E2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007384-25864-2851-00F9A39F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007384-25864-2853-00F9A322 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-2854-00F9A741 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-3518-00F7E55C GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-3698-00F9A232 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-3701-00F9A422 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007384-25864-3702-00F9A7EE38:T8fe,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")39:Ta18,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "11196432824,1712,105,,GetForegroundWindow,user32.dll,"01:10:18.218",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "83045538078,1712,105,,GetForegroundWindow,user32.dll,"01:10:48.156",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007604.00000001.271889.005F0000.00000004.mdmp")3a:T820,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")3b:T556,GetProcessHeap@KERNEL32.DLL at 00000000-00007604-17726-2533-00FA0856 OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-2603-00F21E64 OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-2805-00F27827 OpenProcessToken@ADVAPI32.DLL at 00000000-00007604-17726-3486-00F7BB67 OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-3503-00F7CB44 OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-3505-00F7CBE0 OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-3506-00F7CD1A OpenProcess@KERNEL32.DLL at 00000000-00007604-17726-4286-00F7A8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00007604-17726-4357-00F8A096 GetProcessHeap@KERNEL32.DLL at 00000000-00007604-17726-4374-00F90F32 GetProcessHeap@KERNEL32.DLL at 00000000-00007384-25864-2514-00FA0856 OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-2584-00F21E64 OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-2786-00F27827 OpenProcessToken@ADVAPI32.DLL at 00000000-00007384-25864-3467-00F7BB67 OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-3484-00F7CB44 OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-3486-00F7CBE0 OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-3487-00F7CD1A OpenProcess@KERNEL32.DLL at 00000000-00007384-25864-4267-00F7A8E7 GetProcessHeap@KERNEL32.DLL at 00000000-00007384-25864-4338-00F8A096 GetProcessHeap@KERNEL32.DLL at 00000000-00007384-25864-4355-00F90F323c:T412,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")3d:T1605,"0" (Source: 17726-3348-00F5DC6E, Indicator: "select 'create table vacuum_db.' || substr(sql,14) from sqlite_master where type='table' and name!='sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'" (Source: 17726-3348-00F5DC6E, Indicator: "select 'create index vacuum_db.' || substr(sql,14) from sqlite_master where sql like 'create index %'"), "SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'" (Source: 17726-3348-00F5DC6E, Indicator: "select 'create unique index vacuum_db.' || substr(sql,21) from sqlite_master where sql like 'create unique index %'")3f:Tc43,Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")40:T655,Sleep@KERNEL32.DLL at 00000000-00007604-17726-1268-00F8C196 Sleep@KERNEL32.DLL at 00000000-00007604-17726-2653-00F23598 Sleep@KERNEL32.DLL at 00000000-00007604-17726-2658-00F2379F Sleep@KERNEL32.DLL at 00000000-00007604-17726-2758-00F27123 Sleep@KERNEL32.DLL at 00000000-00007604-17726-2962-00F29CF6 Sleep@KERNEL32.DLL at 00000000-00007604-17726-3374-00F7908D WaitForSingleObject@KERNEL32.DLL at 00000000-00007604-17726-3469-00F7B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00007604-17726-3503-00F7CB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00007604-17726-3504-00F7CB8A Sleep@KERNEL32.DLL at 00000000-00007604-17726-4293-00F7CABD Sleep@KERNEL32.DLL at 00000000-00007604-17726-4301-00F7F116 Sleep@KERNEL32.DLL at 00000000-00007604-17726-4309-00F8022D Sleep@KERNEL32.DLL at 00000000-00007604-17726-4863-00F23731 Sleep@KERNEL32.DLL at 00000000-00007604-17726-4874-00F25ED9 Sleep@KERNEL32.DLL at 00000000-00007604-17726-4875-00F2609A WaitForSingleObject@KERNEL32.DLL at 00000000-00007604-17726-4936-00F804A3 Sleep@KERNEL32.DLL at 00000000-00007384-25864-1249-00F8C196 Sleep@KERNEL32.DLL at 00000000-00007384-25864-2634-00F23598 Sleep@KERNEL32.DLL at 00000000-00007384-25864-2639-00F2379F Sleep@KERNEL32.DLL at 00000000-00007384-25864-2739-00F27123 Sleep@KERNEL32.DLL at 00000000-00007384-25864-2943-00F29CF6 Sleep@KERNEL32.DLL at 00000000-00007384-25864-3355-00F7908D WaitForSingleObject@KERNEL32.DLL at 00000000-00007384-25864-3450-00F7B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00007384-25864-3484-00F7CB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00007384-25864-3485-00F7CB8A41:T652,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")42:T84d,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")43:T40c,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")44:T448,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")45:T580,"SOFTWARE\M/h" in Source: e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 17726-2602-00F21D6D "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 17726-2627-00F220D1 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 17726-2758-00F27123 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp 00000000-00007604.00000001.271889.00F21000.00000040.mdmp 00000000-00007604.00000002.273810.00F21000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp 00000000-00007604.00000001.271889.00F21000.00000040.mdmp 00000000-00007604.00000002.273810.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp 00000000-00007604.00000001.271889.00F21000.00000040.mdmp 00000000-00007604.00000002.273810.00F21000.00000040.mdmp46:T59a,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007384.00000001.271974.00F21000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007604.00000000.269971.00F21000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007604.00000001.271889.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007604.00000001.271889.00F21000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007604.00000001.271889.00F21000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00007604.00000002.273810.00F21000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00007604.00000002.273810.00F21000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007604.00000002.273810.00F21000.00000040.mdmp47:Tde1,"" (Indicator: "GetDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")50:T88e,Found registry query API: "RegQueryValueExW" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "SHGetValueA" in file "00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00007384.00000001.271974.00F21000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp" Found registry query API: "SHGetValueA" in "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp"51:T41e,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")52:T427,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")53:Taff,Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")54:T42a,Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")55:T418,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")56:Teb3,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")57:T43c,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")58:T66e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "DError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")59:Te92,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")5a:T8b3,Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")5b:T412,Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")5c:Te26,Found string "[LEFT]" (Indicator: "[left]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")5d:T81a,Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007384.00000000.270054.009E0000.00000004.mdmp, 00000000-00007384.00000001.271974.009E0000.00000004.mdmp, 00000000-00007384.00000002.273897.009E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\saiec\client.exe" (Indicator: "\Device\"; Source: "00000000-00007384.00000000.270054.009E0000.00000004.mdmp, 00000000-00007384.00000001.271974.009E0000.00000004.mdmp, 00000000-00007384.00000002.273897.009E0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00007384.00000000.270054.03440000.00000002.mdmp, 00000000-00007384.00000001.271974.03440000.00000002.mdmp, 00000000-00007384.00000002.273897.03440000.00000002.mdmp") Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\saiec\client.exe" (Indicator: "\Device\"; Source: "00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp") Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00007604.00000000.269971.03190000.00000002.mdmp, 00000000-00007604.00000001.271889.03190000.00000002.mdmp, 00000000-00007604.00000002.273810.03190000.00000002.mdmp")5e:T616,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")5f:T652,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")60:T8c5,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")61:T44e,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")62:T634,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "e685c5e8ec5ce983408f278a33b236cb355fc0f4cbca9361c920d28ee12de25d.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007384.00000001.271974.00F21000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp")63:Ta9b,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a12cd08276f8d6ceb07100d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007384.00000001.271974.00F21000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007604.00000000.269971.00F21000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007604.00000001.271889.00F21000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007604.00000002.273810.00F21000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a12cd08276f8d6ceb07100d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007604.00000000.269971.005F0000.00000004.mdmp, 00000000-00007604.00000001.271889.005F0000.00000004.mdmp, 00000000-00007604.00000002.273810.005F0000.00000004.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007604.00000000.269971.00F21000.00000040.mdmp, 00000000-00007604.00000001.271889.00F21000.00000040.mdmp, 00000000-00007604.00000002.273810.00F21000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a12cd08276f8d6ceb07100d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"