26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Downloader.Generic Sample e9a8601a49cc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e9a8601a49cc…. Malware family: Downloader.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507","keywords":["Malicious","Downloader.Generic","malware analysis","sandbox report","threat intelligence","e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507"],"about":{"@type":"SoftwareApplication","name":"duxfun.in.net.exe","applicationCategory":["peexe","executable"],"identifier":"e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Downloader.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4e4,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")28:T461,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")29:Tbf2,"0" (Indicator: "select * from "; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "SELECT * FROM \" (Indicator: "select * from "; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" (Indicator: "select * from "; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")31:T944,"0" (Source: 47170-3346-00DEDC6E, Indicator: "select 'create table vacuum_db.' || substr(sql,14) from sqlite_master where type='table' and name!='sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'" (Source: 47170-3346-00DEDC6E, Indicator: "select 'create index vacuum_db.' || substr(sql,14) from sqlite_master where sql like 'create index %'"), "SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'" (Source: 47170-3346-00DEDC6E, Indicator: "select 'create unique index vacuum_db.' || substr(sql,21) from sqlite_master where sql like 'create unique index %'")34:T59e,Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")35:T406,Sleep@KERNEL32.DLL at 00000000-00005944-47170-1266-00E1C196 Sleep@KERNEL32.DLL at 00000000-00005944-47170-2651-00DB3598 Sleep@KERNEL32.DLL at 00000000-00005944-47170-2656-00DB379F Sleep@KERNEL32.DLL at 00000000-00005944-47170-2756-00DB7123 Sleep@KERNEL32.DLL at 00000000-00005944-47170-2960-00DB9CF6 Sleep@KERNEL32.DLL at 00000000-00005944-47170-3372-00E0908D WaitForSingleObject@KERNEL32.DLL at 00000000-00005944-47170-3467-00E0B972 WaitForSingleObject@KERNEL32.DLL at 00000000-00005944-47170-3501-00E0CB44 WaitForSingleObject@KERNEL32.DLL at 00000000-00005944-47170-3502-00E0CB8A Sleep@KERNEL32.DLL at 00000000-00005944-47170-4292-00E0CABD Sleep@KERNEL32.DLL at 00000000-00005944-47170-4300-00E0F116 Sleep@KERNEL32.DLL at 00000000-00005944-47170-4308-00E1022D Sleep@KERNEL32.DLL at 00000000-00005944-47170-4836-00DB3731 Sleep@KERNEL32.DLL at 00000000-00005944-47170-4847-00DB5ED9 Sleep@KERNEL32.DLL at 00000000-00005944-47170-4848-00DB609A WaitForSingleObject@KERNEL32.DLL at 00000000-00005944-47170-4909-00E104A336:Te5c4,Found reference to API (Indicator: "RegCloseKey"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "CryptUnprotectData"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "GetDIBits"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "GetProcAddress"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "VirtualProtect"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "ExitProcess"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "NetUserEnum"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "VariantInit"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "ShellExecuteW"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "GetDC"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "CoInitialize"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "URLDownloadToFileW"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFile2"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CharLowerW"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UuidCreate"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "NetUserEnum"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "URLDownloadToFileW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")37:T6f2,"SOFTWARE\M/h" in Source: e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 47170-2600-00DB1D6D "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 47170-2625-00DB20D1 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 47170-2756-00DB7123 "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005944.00000000.128079.00850000.00000004.mdmp 00000000-00005944.00000001.130001.00850000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00005944.00000000.128079.00850000.00000004.mdmp 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp "\Machine\Software\Microsoft\Win" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "stry\Machine\Software\Micro~" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin.exe" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005944.00000001.130001.008E9000.00000004.mdmp38:T6e4,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005944.00000000.128079.00850000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00005944.00000000.128079.00850000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005944.00000000.128079.00DB1000.00000040.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005944.00000001.130001.00850000.00000004.mdmp "\Machine\Software\Microsoft\Win" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "stry\Machine\Software\Micro~" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin.exe" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00005944.00000001.130001.00896000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005944.00000001.130001.008E9000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" in Source: 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp39:Tc67,"" (Indicator: "GetDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")3e:T670,Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")3f:Ta30,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")40:T410,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "DError33x98dGetProcAddress" (Indicator: "GetProcAddress"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "LgDError33x98dGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")41:Ta2d,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")42:T8ce,Found string "[LEFT]" (Indicator: "[left]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[INSERT]" (Indicator: "[insert]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[END]" (Indicator: "[end]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[BACK]" (Indicator: "[Back]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[LEFT]" (Indicator: "[left]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[RIGHT]" (Indicator: "[right]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[DOWN]" (Indicator: "[down]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[alt]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "[ALT]" (Indicator: "[Alt]"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")43:T597,Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found string "\Device\HarddiskVolume2\e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507.bin.exe" (Indicator: "\Device\"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00896000.00000004.mdmp") Found string "\drivers\etc\HOSTS" (Indicator: "\drivers\"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00005944.00000001.130001.00896000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00005944.00000001.130001.00896000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005944.00000001.130001.00896000.00000004.mdmp")44:T45b,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp")45:T73f,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a02f66d8f06af94b7044735"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005944.00000000.128079.00DB1000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005944.00000001.130001.00DB1000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a02f66d8f06af94b7044735"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a02f66d8f06af94b7044735"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005944.00000000.128079.00850000.00000004.mdmp, 00000000-00005944.00000001.130001.00850000.00000004.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005944.00000000.128079.00DB1000.00000040.mdmp, 00000000-00005944.00000001.130001.00DB1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a02f66d8f06af94b7044735"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"